Submitted by bin2chen
When the bid amount is not enough, the lender will be repaid in order of tranche[].
In order to minimize the risk, the user can specify maxSeniorRepayment to avoid the risk to some extent, and put himself in a position of higher repayment priority. At the same time emitLoan() checks maxSeniorRepayment for the emitLoan().
emitLoan() -> _processOffersFromExecutionData() -> _checkOffer()
totalAmountWithMaxInterest is computed using loan._duration. But when the bidding ends and the distribution is done in LiquidationDistributor.distribute(), the current time is used to calculate Interest.
Because bidding takes a certain amount of time (~3-7 days), using block.timestamp - thisTranche.startTime will be larger than expected! Correctly should use: (loan.startTime + loan.duration - thisTranche.startTime) to calculate the interest.
This leads to the problem that if there are not enough funds, the front lender will get a larger repayment than expected, breaking the back lenders initial expectation of maxSeniorRepayment.
If there are not enough funds, the initial expectation of maxSeniorRepayment may be broken.
Context
0xend (Gondi) confirmed
Gondi mitigated:
Status: Mitigation confirmed. Full details in reports from oakcobalt, bin2chen and minhquanym.
