Liquidators can extract extra value with flash loans, significantly reducing profits for other users

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/main/src/governance/ProfitManager.sol#L342-L405

Vulnerability details

Impact

Liquidators will be able to flash loan mint and stake before liquidating the borrower, extracting maximal potential value. While advantageous for liquidators, this significantly reduces gauge stakers' profits without changing the associated risks.

Proof of Concept

To extract the maximal possible value, bidders (liquidators) will mint with PSM and stake in the gauge they are liquidating. This is because, upon liquidation, onBid calls ProfitManager's notifyPnL, distributing part of the interest to gauge voters. This process is achievable in a single transaction, incentivizing liquidators to do it for every profitable (positive PnL) liquidation.

Example:

Prerequisites	Values
Borrower coll	10,000 USDC
Borrower loan	7,000 USDC
Borrower fees (start + interest)	1,000 USDC
Gauge weight	10,000
PM split - buffer/credit/gauge	20% / 40% / 40%

1. Borrower misses a payment.
2. Call triggers the auction, reaching a profitable point of 8,000 USDC credit for 8,100 USDC collateral.
3. Alice executes a Flash loan transaction:
   • Flash loan 90,000 USDC
   • Mint 90,000 gUSDC
   • Stake 90,000 gUSDC into the gauge
   • Bid on Bob's loan.
   • Call SGM getRewards
   • Unstake 90,000 gUSDC
   • Redeem 90,360 gUSDC
   • Pay the loan

After Alice bids on Bob's loan, calculations are performed, and ProfitManager's notifyPnL is called with 1,000 USDC to split. PM allocates 400 USDC to the gauge. However, Alice holds 90k out of 100k weight (90%), entitling her to 90% of the gauge's profit (360 USDC).

Alice profits 360 USDC from the FL (460 USDC in total) + the gauge tokens that SGM mints as rewardsRatio (360 with rewardRatio of 1), while the remaining gauge stakers split the remaining 40 USDC. This scenario disincentivizes staking for a given gauge, as liquidation becomes a safer and more profitable alternative.

POC

Gist - https://gist.github.com/0x3b33/cf4349253c7762ab4c3d099ecadbea95
Add to - 2023-12-ethereumcreditguild/test/unit/loan/.sol
Run it with - forge test --match-test test_flashLoanExtraProfit

Tools Used

Manual review

Recommended Mitigation Steps

Implementing a dripping mechanism similar to that used with credit tokens (here) may be the most effective solution, albeit making gauges more complex. Alternatively, pausing mint could be considered, but this might only make it more challenging as liquidators can still use flash loans to acquire credits through other means.

Assessed type

Error

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #994

[c4-judge]

Trumpero marked the issue as satisfactory