Lambda - Overdue balances cannot be paid back

[sherlock-admin]

Lambda

medium

Overdue balances cannot be paid back

Summary

UserManager.updateFrozenInfo is only callable by the Comptroller, but not by the UToken.

Vulnerability Detail

UserManager.updateFrozenInfo has the modifier onlyComptroller, which restricts it to calls from the Comptroller (and reverts otherwise). However, the function is also called within UToken when an overdue balance is paid back:

            if (isOverdue) {
                // For borrowers that are paying back overdue balances we need to update their
                // frozen balance and the global total frozen balance on the UserManager
                IUserManager(userManager).updateFrozenInfo(borrower, 0);
            }

Note that the tests do not catch this because a mock user manager is used that does not have this modifier for the updateFrozenInfo function.

Impact

Whenever a user wants to pay back an overdue balance, the call will revert. It is therefore impossible for users to pay back their overdue balances.

Code Snippet

https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/market/UToken.sol#L624

Tool used

Manual Review

Recommendation

Also allow calls from the UToken.

Duplicate of #133