Kow - Lenders can arbitrarily increase borrowers' owed amount forcing default

[sherlock-admin]

Kow

high

Lenders can arbitrarily increase borrowers' owed amount forcing default

Summary

Since anyone can roll any loan, a lender can craft new loan parameters to arbitrarily increase the borrower's owed amount without providing extra collateral.

Vulnerability Detail

Cooler allows lenders to call provideNewTermsForRoll to set new parameters (with no restrictions) for a loan they own, and also allows anyone to call rollLoan to apply these new parameters on any existing loan. This can be exploited to increase a borrower's loaned amount without providing extra collateral.

Consider the following example for a Cooler with debt token DAI, collateral token gOHM:

• Alice makes loan request with the following parameters:
  amount_ = 3000e18
interest_ = 25e15 (2.5% per annum)
  loanToCollateral_ = 3000e18
duration_ = 73 days (1/5 of 365 days)
  She deposits 1e18 gOHM as collateral
• Bob clears the request, sending 3000e18 DAI to Alice (Assume that Alice does not repay anything from here on)
• Bob calls provideNewTermsForRoll on the loan with the following parameters:
  interest = 365e18 (this could be much higher for more severe effect)
  loanToCollateral = 3015e18 (this could be much higher for more severe effect)
  duration = 1 days
• Bob calls rollLoan on the loan. New terms calculated are:
  newCollateral = 3015e18 * 1e18 / 3015e18 = 1e18 <= loan.collateral so newCollateral = 0 (so Bob does not transfer any extra collateral)
  newDebt = (365e18 * 1 days / 365 days) * 3015e18 / 1e18 = 3015e18
loan.amount = 3015e18 + 3015e18 = 6030e18
loan.collateral = 1e18 + 0 = 1e18
loan.expiry = 73 days + 1 days = 74 days

(For the sake of this example, assume that 1 gOHM is worth 3500 DAI (no precision) and the value of the tokens is constant)
Alice's owed amount has doubled while collateral is unchanged, so if she is to repay the loan she is paying double to get back her collateral. She would lose significantly more by repaying, so is forced to default. After the 74 days is up, Bob claims 1e18 gOHM worth 3250 DAI and loses the 3000 DAI he lent, profiting 250 DAI.

Note that the lender can be selective about what loans they clear and can accordingly craft their parameters to make guaranteed profit.

Impact

Borrower is forced to default to avoid greater loss of funds and lender essentially steals collateral.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/6d34cd12a2a15d2c92307d44782d6eae1474ab25/Cooler/src/Cooler.sol#L192-L217
https://github.com/sherlock-audit/2023-08-cooler/blob/6d34cd12a2a15d2c92307d44782d6eae1474ab25/Cooler/src/Cooler.sol#L282-L300

Tool used

Manual Review

Recommendation

Consider validating that the caller of rollLoan is owner().

Duplicate of #26