Submitted by deadrxsezzz
Within Wildcat, withdraw requests are put into batches. Users first queue their withdraws and whenever theres sufficient liquidity, theyre filled at the current rate. Usually, withdraw requests are only executable after the expiry passes and then all users within the batch get a cut from the batch.normalizedAmountPaid proportional to the scaled amount theyve requested a withdraw for.
This makes sure that the sum of all withdraws doesnt exceed the total batch.normalizedAmountPaid.
However, this invariant could be broken, if the market is closed as it allows for a batchs withdraws to be executed, before all requests are added.
Consider the market is made of 3 lenders - Alice, Bob and Laurence.
Note: marking this as High severity as it both could happen intentionally (attacker purposefully queuing numerous low-value withdraws to cause rounding down) and also with normal behaviour in high-value closed access markets where a users withdraw could easily be in the hundreds of thousands.
Also breaks core invariant:
Adding a PoC to showcase the issue:
Although its not a clean fix, consider adding a addNormalizedUnclaimedRewards function which can only be called after a market is closed. It takes token from the user and increases the global variable state.normalizedUnclaimedRewards. The invariant would remain broken, but it will make sure no funds are permanently stuck.
laurenceday (Wildcat) confirmed and commented:
3docSec (judge) commented:
laurenceday (Wildcat) commented:
