updateExchangeRate has no validation result

[code423n4]

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/singularity/Singularity.sol#L119
https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/bigBang/BigBang.sol#L146

Vulnerability details

Impact

Will cause subsequent asset and share conversions to fail

Proof of Concept

For example, the calling path of borrow

call path

borrow->_computeAllowanceAmountInAsset->_computeMaxBorrowableAmount

In _computeMaxBorrowableAmount, exchangeRate is used as the denominator. If it is 0, the calculation cannot be performed normally. The exchangeRate defaults to 0, so it must be executed successfully during initialization, otherwise it will become a hidden problem after the system starts

Tools Used

Manual Review

Recommended Mitigation Steps

plus result verification

    (bool updated, )= updateExchangeRate();
    require(updated, "Market: invalid rate");

Assessed type

Invalid Validation

[c4-pre-sort]

minhquanym marked the issue as low quality report

[c4-pre-sort]

minhquanym marked the issue as primary issue

[minhquanym]

Consider QA

[c4-sponsor]

0xRektora (sponsor) confirmed

[c4-sponsor]

0xRektora marked the issue as disagree with severity

[0xRektora]

Informational. If rate is 0, the Tx will revert, else a cached version will be used. https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/Market.sol#L344

[c4-judge]

dmvt changed the severity to QA (Quality Assurance)

[c4-judge]

dmvt marked the issue as grade-b