Inside Multicall, wrong parameters passed into state.validateBorrowATokenIncreaseLteDebtTokenDecrease allows for unintended behaviour where total supply of borrowAtokens exceed borrowATokenCap despite not being for the purpose of decreasing debt

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-06-size/blob/8850e25fb088898e9cf86f9be1c401ad155bea86/src/libraries/Multicall.sol#L29-L42

Vulnerability details

Impact

Inside multicall, wrong parameters passed into state.validateBorrowATokenIncreaseLteDebtTokenDecrease allows for unintended behaviour where borrowAToken.totalSupply() exceed borrowATokenCap despite not being for the purpose of decreasing debt

Compromises the integrity of state.riskConfig.borrowATokenCap as users can easily deposit USDC into the pool far exceeding the borrowATokenCap even though it is not for reducing debt.

Proof of Concept

The piece of code below shows how user Alice can deposit 2 Million USDC even though the token cap is 1 Million.

function test_multicall_evades_cap() public {
    uint256 amount = 2_000_000e6; // deposits 2 million USDC through multicall to bypass borrowATokenCap
    deal(address(usdc), alice, amount);
    vm.prank(alice);
    IERC20Metadata(address(usdc)).approve(address(size), amount);

    bytes[] memory data = new bytes[](1);
    data[0] = abi.encodeCall(size.deposit, (DepositParams({token: address(usdc), amount: amount, to: alice}))); 
    vm.prank(alice);
    bytes[] memory results = size.multicall(data);
}

The purpose of calling state.validateBorrowATokenIncreaseLteDebtTokenDecrease at the end of of multicall is to allow users to deposit more tokens than the cap allows if it is for the sake of reducing debt. However in the piece of code above, even though no debt was reduced the user was still able to exceed the token cap.

Tools Used

Manual Review

Recommended Mitigation Steps

To fix the issue instead of using borrowAToken.balanceOf(address(this)) use borrowAToken.totalSupply().

 function multicall(State storage state, bytes[] calldata data) internal returns (bytes[] memory results) {
     state.data.isMulticall = true;
        
-    uint256 borrowATokenSupplyBefore = state.data.borrowAToken.balanceOf(address(this));
+    uint256 borrowATokenSupplyBefore = state.data.borrowAToken.totalSupply();
     uint256 debtTokenSupplyBefore = state.data.debtToken.totalSupply();

     .......

-    uint256 borrowATokenSupplyAfter = state.data.borrowAToken.balanceOf(address(this));
+    uint256 borrowATokenSupplyAfter = state.data.borrowAToken.totalSupply();
     uint256 debtTokenSupplyAfter = state.data.debtToken.totalSupply();

     state.validateBorrowATokenIncreaseLteDebtTokenDecrease(
         borrowATokenSupplyBefore, debtTokenSupplyBefore, borrowATokenSupplyAfter, debtTokenSupplyAfter
     );

     state.data.isMulticall = false;
 }

Assessed type

Invalid Validation

[c4-judge]

hansfriese marked the issue as duplicate of #144

[c4-judge]

hansfriese marked the issue as satisfactory

[c4-judge]

hansfriese marked the issue as duplicate of #238