Submitted by 0x1f8b, also found by Critical
https://github.dev/Plex-Engineer/lending-market-v2/blob/2646a7676b721db8a7754bf5503dcd712eab2f8a/contracts/Accountant/AccountantDelegate.sol#L101
The sweepInterest method is susceptible to denial of service.
The logic of the sweepInterest method relative to the treasury is as follows:
As you can see, amtToSweep is passed to it and redeem that amount. Later it is checked that the balance of cnote in the treasury address must be 0. However, all calculations related to amtToSweep come out of the balance of address(this) so if a third party sends a single token cnote to the address of treasury the method will be denied.
nivasan1 (Canto) confirmed
Alex the Entreprenerd (judge) commented:
