Submitted by Evo
https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/CDPVault.sol#L256
https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/CDPVault.sol#L272
The current implementation allows a malicious actor to artificially inflate interest rates for all borrowers in the system through rapid borrow-and-repay cycles. This exploit can lead to:
This vulnerability undermines the fairness and stability of the lending platform, potentially leading to loss of funds for users.
The following test demonstrates the attack by comparing interest accrual with and without the borrow-repay cycles, please add this test function to CDPVault.t.sol test file:
Results from the test output:
The attack results in higher accrued interest for normal borrowers and an increased base interest rate, despite the total debt remaining the same.
The output:
To run the test:
0xtj24 (LoopFi) acknowledged and commented:
Koolex (judge) commented:
0xAlix2 (warden) commented:
pkqs90 (warden) commented:
Koolex (judge) commented:
pkqs90 (warden) commented:
Koolex (judge) commented:
xuwinnie (warden) commented:
pkqs90 (warden) commented:
Koolex (judge) commented:
Note: For full discussion, see here.
