exchangeRate could be zero which allow a user to be solvent even if no collateral was added

[code423n4]

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/bigBang/BigBang.sol#L101

Vulnerability details

Impact

exchangeRate can be zero if updateExchangeRate() failed when calling init(), user then can borrow and be solvent even if the user is not solvent or for example didn't add any collateral. This is against how the protocol is intended to work.

Proof of Concept

In init(), updateExchangeRate() is being called to read value from oracle to set the state variable exchangeRate since it's zero and not initialized yet.

	updateExchangeRate();

Code link

basically the functiion updateExchangeRate() is trying to read the rate from oracle but if it fails it will just take the old rate

    function updateExchangeRate() public returns (bool updated, uint256 rate) {
        (updated, rate) = oracle.get("");


        if (updated) {
            require(rate > 0, "Market: invalid rate");
            exchangeRate = rate;
            emit LogExchangeRate(rate);
        } else {
            // Return the old rate if fetching wasn't successful
            rate = exchangeRate;
        }
    }

Code link

There is a possibility that exchangeRate might fail for the first time getting the rate from oracle thus. Thus, exchangeRate will take the old rate which is zero until updateExchangeRate() called again.

During this time, someone could borrow amount without being solvent. Although, this is an edge case, it is still possible. The protocol should simply set a default value for exchangeRate. or revert any impacted operation if exchangeRate. is still zero.

Tools Used

Manual Review

Recommended Mitigation Steps

Set a default value for exchangeRate.or revert any impacted operation (e.g. borrow) if exchangeRate. is still zero.

Assessed type

Other

[c4-pre-sort]

minhquanym marked the issue as duplicate of #316

[c4-judge]

dmvt changed the severity to QA (Quality Assurance)

[c4-judge]

dmvt marked the issue as grade-b