_partialRepay function is not respecting the minBorrow

[c4-bot-1]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/LendingTerm.sol#L528

Vulnerability details

Terms include a minBorrow, representing the minimum loan amount a user can open:

  function _borrow(
        address borrower,
        uint256 borrowAmount,
        uint256 collateralAmount
    ) internal returns (bytes32 loanId) {
       ...
        // check that enough CREDIT is borrowed
        require(
            borrowAmount >= ProfitManager(refs.profitManager).minBorrow(),
            "LendingTerm: borrow amount too low"
        );

       ...
    }

[Link]

The contract permits maintaining a minimum borrowed amount including the borrow amount.

When we inspect the _partialRepay function we notice that this is no the case in _partialRepay:

function _partialRepay(
        address repayer,
        bytes32 loanId,
        uint256 debtToRepay
    ) internal {
      
       ...
        require(
            borrowAmount - issuanceDecrease >
                ProfitManager(refs.profitManager).minBorrow(),
            "LendingTerm: below min borrow"
        );
       ...

    }

[Link]

In this scenario, the partialRepay function does not permit the maintenance of a minimum borrow, presenting a discrepancy that may lead to various issues.

Impact

A discrepancy in logic operators can pose several problems, particularly in contracts that may be utilized by other contracts as well.

In these instances, if a user want to let his loan with the minimum borrow amount after a repayment, they can´t and they are required to recalculate and execute the transaction again with a reduced payment. In the context of contracts, this behavior introduces a potential risk, as contract executions may fail depending on the design and implementation.

Proof of Concept

Run the next foundry test in file:2023-12-ethereumcreditguild/test/unit/loan /LendingTerm.t.sol

function testPartialRepaySuccessV() public {
        //@note

        // prepare & borrow
        uint256 borrowAmount = 20_000e18;
        uint256 collateralAmount = 15e18;

        collateral.mint(address(this), collateralAmount);
        collateral.approve(address(term), collateralAmount);
        bytes32 loanId = term.borrow(borrowAmount, collateralAmount);

        // repay
        vm.warp(block.timestamp + 1);
        vm.roll(block.number + 1);
        uint256 debt = term.getLoanDebt(loanId);
        uint256 minBorrow = profitManager.minBorrow();

        uint256 repayAmount = debt - minBorrow;
        console.log("repayAmount: ",repayAmount);
        console.log("debt",debt);
        console.log("minBorrow",minBorrow);

        credit.mint(address(this), repayAmount );

        credit.approve(address(term), repayAmount );

        vm.expectRevert();
        term.partialRepay(loanId, repayAmount + 10e18);
    }

Tools Used

Manual. foundry

Recommended Mitigation Steps

Make the partial repay >= to minBorrow:

function _partialRepay(
        address repayer,
        bytes32 loanId,
        uint256 debtToRepay
    ) internal {
      
       ...
        require(
            borrowAmount - issuanceDecrease >=
                ProfitManager(refs.profitManager).minBorrow(),
            "LendingTerm: below min borrow"
        );
       ...

    }

Assessed type

Error

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #1182

[c4-judge]

Trumpero changed the severity to QA (Quality Assurance)

[c4-judge]

Trumpero marked the issue as grade-b

[c4-judge]

Trumpero marked the issue as grade-c