Submitted by minhquanym, also found by oakcobalt and bin2chen
The refinanceFromLoanExecutionData() function is used to refinance a loan from LoanExecutionData. It allows borrowers to use outstanding offers for new loans to refinance their current loan. This function essentially combines two actions: it processes the repayment for the previous loan and then emits a new loan.
The key difference is that the same NFT is used as collateral for the new loan, so it does not need to be transferred out of the protocol and then transferred back in. However, there is no check to ensure that the NFT id of the old loan matches the NFT id of the new execution data.
Therefore, the new loan may have a collateral NFT that does not match the NFT that the lender requested in their offers.
As we can see, executionData.tokenId is passed to the _processOffersFromExecutionData() function instead of loan.nftCollateralTokenId. This function performs all the checks to ensure that the lenders offers accept this NFT.
Eventually, it calls the _checkValidators() function to check the NFT token ID.
However, since executionData.tokenId is passed in, an attacker could pass in a valid tokenId (an NFT id that will be accepted by all lender offers). But in reality, the loan.nftCollateralTokenId will be the NFT kept in escrow.
Add a check to ensure that executionData.tokenId is equal to loan.nftCollateralTokenId.
Invalid Validation
0xend (Gondi) confirmed via duplicate Issue #14
Gondi mitigated:
Status: Mitigation confirmed. Full details in reports from oakcobalt, minhquanym and bin2chen.
