M-15 MitigationConfirmed

[c4-bot-1]

Lines of code

Vulnerability details

C4 Issue

M-15: confirmUnderwriter() need to recalculate getMinTimeBetweenWithdrawalQueues

Comments

Original vulnerabilities/impacts:
The issue raises an edge case where changing the underwriter contract might result in existing immutable getMinTimeBetweenWithdrawalQueues too be too small. When getMinTimeBetweenWithdrawalQueues is too small, when a loan is paid off, the loanId’s associated queue might have already been deleted.

Mitigation

Fix: https://github.com/pixeldaogg/florida-contracts/pull/387/files

//src/lib/loans/LoanManager.sol
    function setUnderwriter(address __underwriter) external onlyOwner {
...
        if (IPoolOfferHandler(__underwriter).getMaxDuration() > IPoolOfferHandler(getUnderwriter).getMaxDuration()) {
            revert InvalidInputError();
        }
...

The mitigation is to check the new underwriter max loan duration (IPoolOfferHandler(__underwriter).getMaxDuration()), and ensure that the new max loan duration is not greater than the existing max loan duration.

The mitigation resolves the issue because as long as the max loan duration will not be reduced, the total maximum duration a loan may take from initiation to liquidation settlement will not be reduced, which means that the existing getMinTimeBetweenWithdrawalQueues will still be valid.

Conclusion

LGTM

[c4-judge]

alex-ppg marked the issue as satisfactory

[c4-judge]

alex-ppg marked the issue as confirmed for report