Extra funds are lost when depositing

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-anchor/blob/7af353e3234837979a19ddc8093dc9ad3c63ab6b/contracts%2Fmoney-market-contracts%2Fcontracts%2Fmarket%2Fsrc%2Fdeposit.rs#L25
https://github.com/code-423n4/2022-02-anchor/blob/7af353e3234837979a19ddc8093dc9ad3c63ab6b/contracts%2Fmoney-market-contracts%2Fcontracts%2Fmarket%2Fsrc%2Fborrow.rs#L126

Vulnerability details

Impact

The money market functions only work on a single native token (info.funds) but don't revert if other native tokens are provided.

pub fn deposit_stable(
    deps: DepsMut,
    env: Env,
    info: MessageInfo,
) -> Result<Response, ContractError> {
    let config: Config = read_config(deps.storage)?;

    // Check base denom deposit
    // @audit other funds besides config.stable_denom are lost
    let deposit_amount: Uint256 = info
        .funds
        .iter()
        .find(|c| c.denom == config.stable_denom)
        .map(|c| Uint256::from(c.amount))
        .unwrap_or_else(Uint256::zero);
  // ...
}

pub fn repay_stable(deps: DepsMut, env: Env, info: MessageInfo) -> Result<Response, ContractError> {
    let config: Config = read_config(deps.storage)?;

    // Check stable denom deposit
    // @audit other funds besides config.stable_denom are lost
    let amount: Uint256 = info
        .funds
        .iter()
        .find(|c| c.denom == config.stable_denom)
        .map(|c| Uint256::from(c.amount))
        .unwrap_or_else(Uint256::zero);

    // ...

Users that call these functions with different funds are losing their funds.

Similar issues have been judged with high / medium severity recently.

Recommended Mitigation Steps

In addition, check that the info.funds has length 1.

[GalloDaSballo]

Personally, I think QA is more appropriate. If people want to send random coins, that's not a vulnerability of the codebase.

However the sponsor did implement a similar check somewhere else