004.md

0xGoodess

medium

there is no way to set a collateral-free loan to LIQUIDATED without preparation of additional fund

Summary

there is no way to set a collateral-free loan to LIQUIDATED without preparation of additional fund

Vulnerability Detail

as Teller permits a collateral-free loan; * @notice Function for a borrower to create a bid for a loan without Collateral.;

comment https://github.com/sherlock-audit/2023-03-teller/blob/main/teller-protocol-v2/packages/contracts/contracts/TellerV2.sol#L263

when such a bid is accepted, this loan would have 2 things different then a collateral-backed loan:

1. isBidCollateralBacked check to return false
2. No escow Proxy deployed.

Now, if the borrower default his payment, the lender would have no choice but express this behavior on the state of this bid. There are only two entry points for the lender:

1. CollateralManager::withdraw, which does nothing since there is no collateral;

2. TellerV2::liquidateLoanFull; however, the lender then would have to, with very sub-optimal UX, to prepare additional fund(see below snippet) in order to execute this self-transfer.

//  @> audit lender himself has to have additional fund in order to pass this self-transfer. 
        // Send payment to the lender
        bid.loanDetails.lendingToken.safeTransferFrom(
            _msgSenderForMarket(bid.marketplaceId),
            lender,
            paymentAmount
        );

https://github.com/sherlock-audit/2023-03-teller/blob/main/teller-protocol-v2/packages/contracts/contracts/TellerV2.sol#L747-L751

Impact

no way for the lender to express the breaking of agreement unless he/shre prepares an equal amount of borrowed fund.

Code Snippet

https://github.com/sherlock-audit/2023-03-teller/blob/main/teller-protocol-v2/packages/contracts/contracts/TellerV2.sol#L676-L704

Tool used

Manual Review

Recommendation

short-circuit the bid to LIQUDIATED in liquidateCollateral if the bid is a collateral-free loan

    function liquidateLoanFull(uint256 _bidId)
        external
        acceptedLoan(_bidId, "liquidateLoan")
    {
        require(isLoanLiquidateable(_bidId), "Loan must be liquidateable.");
+++       if(!CollateralManager.isBidCollateralBacked(_bidId), "bid is collateral-backed") {
+++            bid.state = BidState.LIQUIDATED;
+++            return;
+++         } ....
   }