Submitted by MiloTruck, also found by 0xStalin, GREY-HAWK-REACH, devival, J4X, DarkTower, YusSecurity, and InAllHonesty
Some tokens (eg. AMPL), known as rebasing tokens, have dynamic balances. This means that the token balance of an address could increase or decrease over time.
However, markets in the protocol are unable to handle such changes in token balance. When lenders call depositUpTo(), the amount of assets they deposit is stored as a fixed amount in account.scaledBalance:
WildcatMarket.sol#L56-L65
Afterwards, when lenders want to withdraw their assets, the amount of assets that they can withdraw will be based off this value.
Therefore, since a lenders scaledBalance is fixed and does not change according to the underlying asset balance, lenders will lose funds if they deposit into a market with a rebasing token as the asset.
For example, if AMPL is used as the markets asset, and AMPL rebases to increase the token balance of all its users, lenders in the market will still only be able to withdraw the original amount they deposited multiplied by the markets interest rate. The underlying increase in AMPL will not accrue to anyone, and is only accessible by the borrower by calling borrow().
If a market uses a rebasing tokens as its asset, lenders will lose funds when the asset token rebases.
Consider implementing a token blacklist in the protocol, such as in WildcatArchController, and adding all rebasing tokens to this blacklist.
Additionally, consider documenting that markets are not compatible with rebasing tokens.
ERC20
laurenceday (Wildcat) acknowledged, but disagreed with severity and commented:
0xTheC0der (judge) commented:
Note: For full discussion, see here.
