Blocked accounts keep earning interest contrary to the WhitePaper

mediumCode4rena

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketConfig.sol#L79 https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketBase.sol#L178

Vulnerability details

Impact

Blocked accounts keep earning interest contrary to the WhitePaper

Proof of Concept

Lenders might be flagged as sanctioned by the ChainAnalysis oracle and these lenders can be blocked with the nukeFromOrbit() function or during a withdrawal execution. Both of these functions will call the internal _blockAccount() function.

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketBase.sol#L163

solidity📋
  function _blockAccount(MarketState memory state, address accountAddress) internal {

      // skipped for brevity
@>    if (scaledBalance > 0) {
        account.scaledBalance = 0;
        address escrow = IWildcatSanctionsSentinel(sentinel).createEscrow(
          accountAddress,
          borrower,
          address(this)
        );
        emit Transfer(accountAddress, escrow, state.normalizeAmount(scaledBalance));
@>      _accounts[escrow].scaledBalance += scaledBalance;
        
      // skipped for brevity
    }
  }

As we can see above, if the user's scaled balance is greater than zero, an escrow contract is created for market tokens and the scaled token balance is transferred to the escrow contract.

In this protocol, there are two types of tokens: Underlying tokens, and market tokens. Market tokens are used for internal balance accounting and it is tracked with scaled balances. Underlying tokens are tracked with normalized balances. scaleFactor is the value that provides accumulated interest, and increment with every state update. scaled balances are multiplied by the scaleFactor and this will provide the normalized balances.

• scaled balances do earn interest.

• normalized balances do not earn interest.

According to the protocol's WhitePaper (page 16), blocked accounts should not earn interest. "The effect of this would be that an auxiliary escrow contract is deployed and the debt obligation of the borrower towards the lender is transferred to this new contract. Interest does not accrue within this contract from the time the debt is transferred, and the borrower is expected to immediately return the balance of funds due up to that time to the escrow contract."

However, because the escrow contract holds scaled balances, these funds will keep earning interest.
These scaled balances will be normalized when the funds are released (after the sanction is removed) according to that date's scaleFactor.

Note: There might be two escrow contract for the same lender if it is triggered during withdrawal request. One with market tokens and the other with underlying tokens. The one with underlying tokens does not earn interest as expected. However, the escrow with the market tokens will still keep earning interest. I believe a blocked account earning interest contradicts the idea of the blocking.

Tools Used

Manuel review, reading

Recommended Mitigation Steps

I think all of the scaled balances should be normalized before transferring to the escrow contract to stop earning interest.

Assessed type

Context