Wrong Operator used for expectedCollateral

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-06-badger/blob/9173558ee1ac8a78a7ae0a39b97b50ff0dd9e0f8/ebtc-zap-router/src/LeverageZapRouterBase.sol#L265-L274
https://github.com/code-423n4/2024-06-badger/blob/9173558ee1ac8a78a7ae0a39b97b50ff0dd9e0f8/ebtc-protocol/packages/contracts/contracts/LeverageMacroBase.sol#L211
https://github.com/code-423n4/2024-06-badger/blob/9173558ee1ac8a78a7ae0a39b97b50ff0dd9e0f8/ebtc-protocol/packages/contracts/contracts/LeverageMacroBase.sol#L281-L282

Vulnerability details

Impact

In PostCheckParams, the expectedCollateral is initialized as _totalCollateral * _collValidationBuffer / BPS with a gte operator. This signifies that the check is _totalCollateral * _collValidationBuffer / BPS >= cdpInfo.coll which is inconsistent with the intended design. As a slippage control, the cdpInfo.coll is expected to be higher than _collValidationBuffer of _totalCollateral provided.

Proof of Concept

In PostCheckParams, the expectedCollateral is initialized as _totalCollateral * _collValidationBuffer / BPS with a gte operator.

	expectedCollateral: CheckValueAndType({
		value:  _totalCollateral * _collValidationBuffer / BPS,
		operator: Operator.gte
	}),

It is later used in the postcheck.

	 _doCheckValueType(checkParams.expectedCollateral, cdpInfo.coll);

This actually checks that:

	check.value = _totalCollateral * _collValidationBuffer / BPS >= cdpInfo.coll

According to the sponsor, this is used as a laxer check post swap: when you expect after openCdp, the collateral will be 5 stETH, setting it to 100% will ensure that the collateral is at least 5 stETH.

This is not consistent with what is checking here and thus it is an invalid check which will cause unexpected revert and prevent the protocol from working correctly.

Tools Used

Manual

Recommended Mitigation Steps

Change the operator from gte to lte.

Assessed type

Invalid Validation