carrotsmuggler - Lenders can jack up interest rates to force borrowers to pay more.

[sherlock-admin2]

carrotsmuggler

high

Lenders can jack up interest rates to force borrowers to pay more.

Summary

Lenders can jack up interest rates to force borrowers to pay more.

Vulnerability Detail

The function provideNewTermsForRoll can be used by lenders to change the loan parameters. This can be used to change the interest rate, duration, and loan-to-collateral ratios.

The new loan terms can be applied to the loan by calling the rollLoan function. Lenders can set up new loan parameters and can force borrowers to pay more interest. In the rollLoan function, the extra collateral needed to cover the loan is calculated and stored in the newCollateral variable.

uint256 newCollateral = newCollateralFor(loanID_);
uint256 newDebt = interestFor(
    loan.amount,
    loan.request.interest,
    loan.request.duration
);

// Update memory accordingly.
loan.amount += newDebt;
loan.collateral += newCollateral;
loan.expiry += loan.request.duration;
loan.request.active = false;

// Save updated loan info in storage.
loans[loanID_] = loan;

Here we see the new collateral amount, and the new interest amount are calculated and the loan is updated. The newCollateral value is actually charged from the msg.sender, so the lender needs to keep this at 0 to not pay anything. This can be done by setting a lower loanToCollateral ratio. This can be understood from the implementation of the newCollateralFor function.

function newCollateralFor(uint256 loanID_) public view returns (uint256) {
    Loan memory loan = loans[loanID_];
    // Accounts for all outstanding debt (borrowed amount + interest).
    uint256 neededCollateral = collateralFor(
        loan.amount,
        loan.request.loanToCollateral
    );

    return
        neededCollateral > loan.collateral
            ? neededCollateral - loan.collateral
            : 0;
}

Here, if the newCollateral is lower than the existing loan.collateral, the newCollateral is set to 0. To ensure this, the lender can set a lower value of loanToCollateral ratio. This will ensure that the newCollateral is lower than the existing collateral, and thus the lender will not have to pay anything. The borrower will have their loan updated with a larger interest amount.

Assume Alice is the borrower, and Bob is the lender.

1. Alice sets up a loan request. Loan amount is 100 USD, loan-to-collateral is 0.5. Interest is 10% pa. Duration is 1 year.
2. collateralFor(100,0.5) = 200 So alice pays collateral worth 200 USD to the contract. Due to 10% interest, Alice has to repay 110 USD after 1 year.
3. Bob fulfills the loan request. Bob pays 100 USD to the contract, which is the loan amount. loan.amount is set to 110 (principal + interest)
4. Bob resets the loan parameters with interest of 1000% pa, duration of 0, and loantocollateral of 0.8.
5. In the rollLoan function, newCollateral is calculated from collateralFor(110,0.8)=137.5. Since this is less than 200, newCollateral is set to 0.
6. newDebt is calculated as the interest at the updated rate of 1000% pa. So newDebt=1210.

Now Alice is forced to pay 1210 USD. Alice will never pay that loan, but the attacker can change the numbers until Alice is forced to pay almost 200 USD of the loan and force Alice to give up all her collateral.

Impact

Borrowers can have their interest rates changed on them.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L192-L217

Tool used

Manual Review

Recommendation

Enforce the same loantovalue and interest for rolled-over loans.

Duplicate of #26