Note: At the judges request here, this downgraded issue from the same warden has been included in this report for completeness.
https://github.com/code-423n4/2024-04-gondi/blob/b9863d73c08fcdd2337dc80a8b5e0917e18b036c/src/lib/AuctionWithBuyoutLoanLiquidator.sol#L69
The settleWithBuyout() function is used to settle an auction with a buyout from the main lender. It calculates the main lender by looping through all the tranches and selecting the lender of the largest tranche as the main lender.
However, this is incorrect as a single lender could have multiple tranches. This could be abused by a borrower to manipulate the selection of the main lender.
Consider the following scenario:
As you can see, even though Alice lend 40 eth to Caleb, Bob will be the main lender. And also since the tranche of Alice is not consecutive (Caleb intentionally put 0.01 eth in between), they cannot be merged as well.
To get the correct main lender, sum up the total principal in different tranches from the same lender.
0xend (Gondi) commented:
0xA5DF (judge) decreased severity to Low and commented:
0xA5DF (judge) commented:
For this audit, 1 report was submitted by wardens detailing gas optimizations. The report highlighted below by erebus received the top score from the judge.
