A borrower can use the liquidity of the vault without paying any fees if he repay in the same block

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/V3Vault.sol#L954

Vulnerability details

Impact

A borrower can use the liquidity of the vault without paying any fees. A liquidator can use the liquidity of the protocol to make a liquidation. The functionality to do a liquidation with an Uniswap flashLoan is useless.

Proof of Concept

A borrower can use the liquidity of the vault without paying any fees. A liquidator can use the liquidity of the protocol to make a liquidation. The functionality to do a liquidation with an Uniswap flashLoan is useless.

When a user borrows the protocol increase his debt and he receive the amount that he borrowed. The problem is that a user can repay at any time, he can repay exactly the same amount that he borrowed if he repay in the same block, and basically give him a free flashloan. users could use this to do arbitrages or worse liquidation in the protocol itself. If a position is liquidable and the lend amount is bigger than the debt a liquidator could borrow pay the liquidation cost get the liquidation value repay exactly the same amount. He then performed a liquidation without taking any risk or paying any fees.

You can run this test in the VaultV3.t.sol

 function testFreeFlashloan() external {
    _setupBasicLoan(true);
    (, uint256 fullValue, uint256 collateralValue,,) = vault.loanInfo(TEST_NFT);
    vm.startPrank(TEST_NFT_ACCOUNT);
    USDC.approve(address(vault), collateralValue);
    vault.repay(TEST_NFT,collateralValue,false);
    vm.stopPrank();
    (uint256 debt, , ,,) = vault.loanInfo(TEST_NFT);
    assertEq(debt,0);
   }

Tools Used

Echidna

Recommended Mitigation Steps

The protocol should add a variable in the Loan struct, increment it in the borrow function(L567-L570) add require in the _repay function(L957-L960).

struct Loan {
        uint256 debtShares;
        uint256 timeOfBorrow;
    }

borrow function:

 uint256 loanDebtShares = loan.debtShares + shares;
        loan.debtShares = loanDebtShares;
        loan.timeOfBorrow = block.timestamp; 
        debtSharesTotal += shares;

in the _repay function:

  Loan storage loan = loans[tokenId];
  require(loan.timeOfBorrow> block.timestamp,"Could not repay in the same block");
        uint256 currentShares = loan.debtShares;

Assessed type

MEV

[c4-pre-sort]

0xEVom marked the issue as duplicate of #435

[c4-pre-sort]

0xEVom marked the issue as sufficient quality report

[jhsagd76]

he needs to swap coll and debt

[c4-judge]

jhsagd76 changed the severity to 2 (Med Risk)

[c4-judge]

jhsagd76 marked the issue as satisfactory