thank_you - Borrower can escape paying last payment cycle interest

[sherlock-admin3]

thank_you

medium

Borrower can escape paying last payment cycle interest

Summary

If a borrower is on their second to last payment cycle and does not pay by the paymentDueBy, the borrower will be on their last payment cycle. When the borrower then calls OCC_Modular.callLoan(), the borrower will pay the late fee and the interest for the second-to-last payment cycle. This allows the borrower to avoid having to pay the last payment cycle interest.

Vulnerability Detail

When amountOwed() is called, the late fee is calculated as the interest owed for a single payment cycle:

interest = loans[id].principalOwed * loans[id].paymentInterval * loans[id].APR / (86400 * 365 * BIPS);

Let's assume a borrower is on the second to last payment cycle. Let's consider the scenario:

1. Borrower is on the second to last payment cycle.
2. Borrower does not pay payment on time. Borrower begins to incur late fees. The borrower is now on their last payment cycle.
3. Borrower calls OCC_Modular.callLoan(). The following occurs:
   • Borrower's interestOwed will equal the interest owed for a single payment cycle. This is calculated from amountOwed().
   • Borrower's lateFee will be above 0. This is calculated from amountOwed().
4. Loan is paid off.

In the scenario above, the borrower pays for the interestOwed from the second-to-last payment cycle and the late fee. The problem here is that the borrower should also pay the interest for the last payment cycle, since they are currently on the last payment cycle. By calling OCC_Modular.callLoan(), the borrower avoids paying this last payment cycle.

Impact

Borrower avoids having to pay the last interest payment cycle when calling OCC_Modular.callLoan().

Code Snippet

https://github.com/sherlock-audit/2024-03-zivoe/blob/d4111645b19a1ad3ccc899bea073b6f19be04ccd/zivoe-core-foundry/src/lockers/OCC/OCC_Modular.sol?plain=1#L492-L518

https://github.com/sherlock-audit/2024-03-zivoe/blob/d4111645b19a1ad3ccc899bea073b6f19be04ccd/zivoe-core-foundry/src/lockers/OCC/OCC_Modular.sol?plain=1#L440-L457

Tool used

Manual Review

Recommendation

When OCC_Modular.callLoan() is called, Zivoe should require the borrower to pay the last payment cycle's interest payment.

Duplicate of #97

[pseudonaut]

Intended

[sherlock-admin4]

1 comment(s) were left on this issue during the judging contest.

panprog commented:

medium, dup of #97, if there are more than 1 interest payments missed by borrower, then callLoan takes only 1 period payment, allowing borrower to skip paying the other periods interest and lateFee payments.