A malicious borrower is able to brick the Auction when the collateralToken is ERC777

[c4-bot-1]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/AuctionHouse.sol#L180-L186
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/LendingTerm.sol#L805-L808

Vulnerability details

Impact

When the collateralToken is ERC777, then a malicious borrower is able to brick the Auction and prevent the bidder from claiming/withdrawing the auctioned collateral.
Due to that, the bidder can't bid/claim/withdraw the collateral.

Proof of Concept

When bid is called, a portion of collateral will sent-back to the borrower:

LendingTerm(_lendingTerm).onBid(
    loanId,
    msg.sender,
    auctions[loanId].collateralAmount - collateralReceived, // @audit collateralToBorrower will be sent-back to borrower
    collateralReceived, // collateralToBidder
    creditAsked // creditFromBidder
);

Then it triggers onBid which sends-back that portion of collateral to the borrower:

if (collateralToBorrower != 0) {
     IERC20(params.collateralToken).safeTransfer(
          loans[loanId].borrower,
          collateralToBorrower
     );
}

safeTransfer will trigger the transfer function of collateralToken, if collateralToken is ERC777 then it triggers the tokensReceived function of borrower if the borrower is a contract.
So a malicious borrower-contract can simply write a revert() on its contract (in tokensReceived) which always reverts the transaction.
Now there is no way for bidder to bid and claim the collateral, because the transaction will be reverted by borrower-contract.

Note: There is not mentioned in README and Docs that the ERC777's are not supported for collateralToken and the sponsor confirmed it.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider correct handling of ERC777's collateral tokens.

Assessed type

DoS

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #685

[c4-judge]

Trumpero changed the severity to QA (Quality Assurance)

[c4-judge]

Trumpero marked the issue as grade-b

[c4-judge]

This previously downgraded issue has been upgraded by Trumpero

[c4-judge]

Trumpero marked the issue as not a duplicate

[c4-judge]

Trumpero marked the issue as duplicate of #184

[c4-judge]

Trumpero marked the issue as satisfactory

[thebrittfactor]

For transparency, the judge has requested for the grade-b label to be removed.

[c4-judge]

Trumpero marked the issue as unsatisfactory:
Out of scope