Submitted by 3docSec, also found by stackachu, serial-coder, Toshii, josephdara, MiloTruck, gizzy, smiling_heretic, TrungOre, Tricko, 0xbrett8571, ZdravkoHr, deth, joaovwfreire, caventa, 0xbepresent, b0g0, ggg_ttt_hhh, Eigenvectors, cu5t0mpeo, and 0xCiphky
When a WildcatMarketController is created, it is hardcoded with a MinimumAnnualInterestBips and MaximumAnnualInterestBips range that cannot be changed; these values come from WildcatMarketControllerFactory where they are specified by the protocol owners.
When a market is created at the borrowers request, the annual interest requested by the borrower is validated to sit within these bounds.
However, the borrower is also allowed to change this value at a later point through the WildcatMarketController.setAnnualInterestBips function. This entry point does not offer any validation, except for the downstream WildcatMarket.setAnnualInterestBips that checks for the value not to exceed BIPS.
After the creation of a market, the borrower is allowed to change its annual interest outside the bounds allowed by the protocol.
Foundry
Consider introducing the validation of the new interest rate:
Invalid Validation
laurenceday (Wildcat) commented:
laurenceday (Wildcat) confirmed
