Submitted by said
When users construct repay operations via MoneyMarketHook, it doesnt consider the actual debt shares of the position inside the InitCore and PosManager. This could lead to users tokens getting stuck inside the MoneyMarketHook contract.
When users want to repay his positions in MoneyMarketHook, they can provide the parameters inside repayParams, and MoneyMarketHook will construct the operation via _handleRepay function.
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/hook/MoneyMarketHook.sol#L145-L159
It can be observed that it calculates the repayAmt based on the shares provided by the users and transfers the corresponding amount of tokens from the sender to the hook. However, the actual debt shares of the position can be less than the _params[i].shares provided by users. This means that the actual repay amount of tokens needed could be less than the calculated repayAmt.
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L530-L551
Consider a scenario where the users positions are currently liquidatable, and the user wishes to repay all of the positions debt inside the MoneyMarketHook. However, a liquidator front-runs the operation by liquidating the users position. Now, when the repayment operation executes from MoneyMarketHook, it transfers the repayAmt to the MoneyMarketHook but the amount is not used/fully utilized and becomes stuck inside the contract.
Consider to also check the provided shares against the actual debt shares inside the InitCore/PosManager.
fez-init (INIT) confirmed, but disagreed with severity and commented:
hansfriese (Judge) commented:
