mediumLogic errorSolana-Rust
Lavarage: Borrowers can avoid the payment of an interest share fee by setting themselves as a `fee_receipient`
- Payout
- $0
- Protocol
- Lavarage
- Disclosed
- May 29, 2024
- Source
- code4rena
Lavarage's repay_sol routine deducts a 20% interest-share fee from a borrower's accumulated interest and forwards it to a fee_receipient account. That destination is entirely caller-supplied: it is declared as an UncheckedAccount with no validation tying it to …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-04-lavarage-findings/issues/18
- https://github.com/code-423n4/2024-04-lavarage-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.