Incorrect address was used to check whether the variable pool has enough liquidity

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-06-size/blob/main/src/libraries/CapsLibrary.sol#L67-L72

Vulnerability details

Impact

The critical functions listed below are unlikely to execute successfully, causing the Size protocol to stop working:

• buyCreditMarket()
• sellCreditMarket()
• liquidateWithReplacement()

Proof of Concept

A eligible user (seller) can sell their credit for szaUSDC by calling sellCreditMarket(). sellCreditMarket() will check if the variable pool has enough liquidity to make sure the seller can redeem szaUSDC for USDC laterly.

Size#sellCreditMarket():

    function sellCreditMarket(SellCreditMarketParams memory params) external payable override(ISize) whenNotPaused {
        state.validateSellCreditMarket(params);
        uint256 amount = state.executeSellCreditMarket(params);
        if (params.creditPositionId == RESERVED_ID) {
            state.validateUserIsNotBelowOpeningLimitBorrowCR(msg.sender);
        }
@>      state.validateVariablePoolHasEnoughLiquidity(amount);
    }

CapsLibrary#validateVariablePoolHasEnoughLiquidity():

    function validateVariablePoolHasEnoughLiquidity(State storage state, uint256 amount) public view {
@>      uint256 liquidity = state.data.underlyingBorrowToken.balanceOf(address(state.data.variablePool));
        if (liquidity < amount) {
            revert Errors.NOT_ENOUGH_BORROW_ATOKEN_LIQUIDITY(liquidity, amount);
        }
    }

As we all know, state.data.variablePool is the AAVE v3 pool, the address of which on Ethereum is 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2. However, When USDC token is deposited in AAVE, it will be transferred into its aToken address: 0x98C23E9d8f34FEFb1B7BD6a91B7FF122F4e16F5c

validateVariablePoolHasEnoughLiquidity() used the incorrect address(state.data.variablePool) to check the underlyingBorrowToken balance, resulting in it likely failing to execute successfully. Any functions calling validateVariablePoolHasEnoughLiquidity() to check the variable pool liquidity will revert.

Tools Used

Manual review

Recommended Mitigation Steps

Correct the address used for USDC balance check:

    function validateVariablePoolHasEnoughLiquidity(State storage state, uint256 amount) public view {
-       uint256 liquidity = state.data.underlyingBorrowToken.balanceOf(address(state.data.variablePool));
+       address aToken = state.data.variablePool.getReserveData(address(state.data.underlyingBorrowToken)).aTokenAddress;
+       uint256 liquidity = state.data.underlyingBorrowToken.balanceOf(aToken);
        if (liquidity < amount) {
            revert Errors.NOT_ENOUGH_BORROW_ATOKEN_LIQUIDITY(liquidity, amount);
        }
    }

Assessed type

Context

[c4-judge]

hansfriese changed the severity to 3 (High Risk)

[c4-judge]

hansfriese marked the issue as satisfactory

[c4-judge]

hansfriese changed the severity to 2 (Med Risk)