Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgraded Q -> 2 from #258 [1706641869227] #1277

Closed
c4-judge opened this issue Jan 30, 2024 · 3 comments
Closed

Upgraded Q -> 2 from #258 [1706641869227] #1277

c4-judge opened this issue Jan 30, 2024 · 3 comments
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value duplicate-994 partial-50 Incomplete articulation of vulnerability; eligible for partial credit only (50%)

Comments

@c4-judge
Copy link
Contributor

Judge has assessed an item in Issue #258 as 2 risk. The relevant finding follows:

[L-9] Any borrower can receive rewards by adding weight to the term before repayment.

When interests accrue from borrowers, these interests are immediately distributed to token holders based on their respective weights.
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/ProfitManager.sol#L396-L399

function notifyPnL() {
    gaugeProfitIndex[gauge] = _gaugeProfitIndex + (amountForGuild * 1e18) / _gaugeWeight;
}

Hence, any borrower can add weight before repayment, receive rewards, and subsequently withdraw their added weight.
Need a logic similar to rebasing tokens.

@c4-judge c4-judge added the 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value label Jan 30, 2024
@c4-judge
Copy link
Contributor Author

Trumpero marked the issue as duplicate of #994

@Trumpero
Copy link

This issue should receive only 50% partial credit due to its lack of quality and evidence

@c4-judge
Copy link
Contributor Author

Trumpero marked the issue as partial-50

@c4-judge c4-judge added the partial-50 Incomplete articulation of vulnerability; eligible for partial credit only (50%) label Jan 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value duplicate-994 partial-50 Incomplete articulation of vulnerability; eligible for partial credit only (50%)
Projects
None yet
Development

No branches or pull requests

2 participants