Submitted by KingNFT, also found by __141345__, adriro, and Ch_301
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L388
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L488
When the credit token is ERC20 extensive with hook, such as ERC777 token, the lender can exploit it to draw out extra tokens from borrowers account. And the count state variable would also be underflowed, cause the line contract cant be REPAID, the borrower will never be able to get back the collateral.
P.S.
Similar attack on imBTC
The vulnerable point is in \_close() function,
The following testcase shows how to exploit it, put it into a new LenderExploit.t.sol file under test directory, it will pass
Related links:
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L388
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L488
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/EscrowLib.sol#L173
VS Code
Add reentrancy protection on close() function.
dmvt (judge) decreased severity to Medium and commented:
kibagateaux (Debt DAO) commented:
dmvt (judge) commented:
