kutugu - takeOverDebt does not have expiration time protection

[sherlock-admin2]

kutugu

medium

takeOverDebt does not have expiration time protection

Summary

takeOverDebt, borrow, and repay are all important entrances for users to interact with funds. On low-throughput networks such as Ethereum, expiration time protection should be added to prevent transactions from staying for a long time before being executed, consuming users' funds beyond expectations.
However, only borrow and repay in the contract have expiration time protection, but takeOverDebt does not.

Vulnerability Detail

    function takeOverDebt(bytes32 borrowingKey, uint256 collateralAmt) external

    function borrow(
        BorrowParams calldata params,
        uint256 deadline
    ) external nonReentrant checkDeadline(deadline)

    function repay(
        RepayParams calldata params,
        uint256 deadline
    ) external nonReentrant checkDeadline(deadline)

takeOverDebt will transfer ownership based on the current status of the loan. The user needs to transfer the required collateral and feeDebt to the contract to take over the loan.
takeOverDebt does not add expiration time protection, and the transaction may not be executed until a long time later. At this time, the funds required by the user may be far more than expected, and the loan may continue to depreciate as a non-performing asset, resulting in capital losses.

Impact

User transactions may take a long time to be executed, and the funds spent may be far more than expected. And loans, as non-performing assets, may lead to financial losses.

Code Snippet

• https://github.com/sherlock-audit/2023-10-real-wagmi/blob/b33752757fd6a9f404b8577c1eae6c5774b3a0db/wagmi-leverage/contracts/LiquidityBorrowingManager.sol#L395

Tool used

Manual Review

Recommendation

Add expiration time protection for takeOverDebt