Skip to content

Conversation

@betmoardotfun
Copy link

Main changes are

  1. unintended delegate call due to pow function being public instead of internal (found out issue when testing post deployment)
  2. vulnerability introduced due to auction interest calculation not starting from InterestLib.ONE
  3. correction of error where requestId & offerId usage appears to be swapped accidentally

More details are in the individual commit descriptions. Looking forward to contributing back and making the repository better, learnt a lot diving into the code and deploying a functional version of it.

on deployment testing observed that when this function is called it reverts as it attempts to delegatecall to a non existent contract to execute this function. fixed by changing it from public to internal.
due to the previous method of calculation it leads to value of < InterstLib.ONE when called early on. 

This results in amountOwed going to 0 over time rather than increasing as intended leading to loss for USDC lender.

Fixed by calculating the linear auction rate with a baseline from InterestLib.ONE
match vuln fix update for rate calc.
previous version used offerId for requests and requestId for offers.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant