Atomic Ceramic Flamingo
High
Malicious borrowers can monitor the mempool for the question resolution transaction, and if it goes against their bet, they will frontrun the question resolution transaction to obtain loans with soon-to-be worthless collateral.
The functions acceptLoanOffer, acceptLoanOfferAndFillOrder, and matchProposals allow a borrower to take a loan of USDB/USDC using CTF tokens as collateral. The value of CTF tokens is based on the question they correspond to, similar to a bet.
For instance, if a question has a YES or NO answer, and the borrower has CTF tokens tied to the YES answer but the question is resolved as NO, the CTF tokens become worthless at the moment the question resolution becomes available.
Consequently, a malicious borrower can monitor the mempool for the question price availability transaction. If the resolution goes against their initial bet, they can frontrun the transaction by calling acceptLoanOffer, acceptLoanOfferAndFillOrder, or matchProposals to take a loan of valuable USDB/USDC against their soon-to-be worthless collateral.
This vulnerability allows borrowers to obtain loans with collateral that is about to become worthless.
- An active loan offer needs to exist in the system.
- The transaction for question resolution must be visible in the mempool (and the README states that the contracts can be deployed on "potentially any EVM chains with a prediction market that uses Polymarket's CTF exchange and neg risk protocol").
- The malicious borrower monitors the mempool for incoming question resolution transactions.
- When a resolution transaction is detected and is unfavorable to the borrower's position, they frontrun it with a call to
matchProposals(),acceptLoanOffer, oracceptLoanOfferAndFillOrder. - The loan is issued to the borrower, with soon-to-be worthless CTF tokens as collateral.
- The question resolution transaction executes, rendering the CTF tokens worthless.
- The borrower defaults on the loan, keeping the borrowed USDB/USDC while the lender is left with worthless collateral.
The lenders suffer a complete loss of the loaned amount (USDB/USDC). The attackers gain this full amount by exploiting the timing of the question resolution. This vulnerability undermines the entire lending system, as it allows borrowers to obtain risk-free loans and profit at the expense of lenders.
No response
No response