HollaDieWaldfee - Cooler: repay function can be front-run so borrowers transaction reverts

[github-actions]

HollaDieWaldfee

medium

Cooler: repay function can be front-run so borrowers transaction reverts

Summary

The Cooler.repay function is used to repay a loan.
An attacker can call this function with a very small amount and front-run the borrower's transaction to fully repay the loan.
Thereby the borrower's transaction reverts because loan.amount -= repaid underflows:

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/Cooler.sol#L118

Vulnerability Detail

The vulnerable function:

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/Cooler.sol#L108-L124

The line that reverts when an attacker front-runs the victim and the victim tries to repay the full loan:

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/Cooler.sol#L118

Impact

An attacker can DOS transactions of users that try to repay the full loan.

Code Snippet

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/Cooler.sol#L108-L124

Tool used

Manual Review

Recommendation

Only allow the borrower to repay his loan or if repaid > loan.amount then only transfer loan.amount: debt.transferFrom(msg.sender, loan.lender, loan.amount);

Duplicate of #218