Submitted by evan, also found by PaludoX0
https://github.com/code-423n4/2023-01-astaria/blob/main/src/PublicVault.sol#L597-L609
https://github.com/code-423n4/2023-01-astaria/blob/main/src/LienToken.sol#L819
Strategist interest reward is not calculated correctly. The reward will almost always be calculated with interestOwed, regardless of the amount paid.
As a result, the strategist gets paid more than they are supposed to. Even if the borrower hasnt made a single payment, the strategist can make a tiny payment on behalf of the borrower to trigger this calculation.
This also encourages the strategist to maximize interestOwed and make tiny payments on behalf of the borrower. This can trigger a compound interest vulnerability which Ive made a separate report about.
As confirmed by the sponsor, the strategist reward is supposed to be paid on performance and only@on interest. if the payment thats being made is greater than the interest owing we only mint them based on the interest owed, but if its less, then, mint their shares based on the amount
However, this is not the case. When LienToken calls beforePayment, which calls _handleStrategistInterestReward, the amount passed in is the amount of the lien (stack.point.amount), not the amount paid.
VSCode
https://github.com/code-423n4/2023-01-astaria/blob/main/src/LienToken.sol#L819
I believe stack.point.amount should be changed to amount.
androolloyd (Astaria) commented:
SantiagoGregory (Astaria) acknowledged
Picodes (judge) commented:
