Builder can lock in a temporarily low lender fee for all future projects

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-rigor/blob/5ab7ea84a1516cb726421ef690af5bc41029f88f/contracts/Project.sol#L102

Vulnerability details

Impact

The admin has the capability to adjust the lender fee by calling the replaceLenderFee() function in the HomeFi.sol contract.

However, users have the ability to lock in future projects at the current 0.5% rate. If the rate is ever temporarily lowered or set to zero, they will also be able to lock in at that lower rate.

This happens because the lender fee is saved in the project initialization (when the createProject() function is called), and not pulled dynamically from the HomeFi.sol contract at the time of the loan. Since users can create unlimited projects at any time without any specific commitment, they can create an arbitrary number of contracts with the lower rate locked in for future use.

Proof of Concept

When createProject() is called, it calls out to the project factory's createProject() function.

address _project = projectFactoryInstance.createProject(
    _currency,
    _sender
);

This function clones and initializes a new instance of Project.sol:

// Create clone of Project implementation
_clone = ClonesUpgradeable.clone(underlying);

// Initialize project
Project(_clone).initialize(_currency, _sender, homeFi);

Finally, this initialize() function sets the project's parameters, including calling out to HomeFi.sol to fetch the current lender fee:

function initialize(address _currency, address _sender, address _homeFiAddress) external override initializer {
    // Initialize 
    homeFi = IHomeFi(_homeFiAddress);
    disputes = homeFi.disputesContract();
    lenderFee = homeFi.lenderFee();
    builder = _sender; 
    currency = IDebtToken(_currency);
}

This permanently sets the lender fee for the project to homeFi.lenderFee() at the time it is created, with no mechanism to update or override this fee.

As a result, when _lenderFee is calculated and sent to the treasury in the lendToProject() function of Community.sol, it is fixed at the original rate.

// Calculate lenderFee
uint256 _lenderFee = (_lendingAmount * _projectInstance.lenderFee()) / (_projectInstance.lenderFee() + 1000);

Tools Used

VS Code, vim, hardhat

Recommended Mitigation Steps

Community.sol can call directly to the HomeFi contract to get the current lenderFee() at the time the lendToProject() function is called.

uint256 _lenderFee = (_lendingAmount * homeFi.lenderFee()) / (homeFi.lenderFee() + 1000);

This will allow the protocol to dynamically update the lender fee and have the result of updating all projects going forward, as well as stopping malicious users from locking in low lender fees.

[zgorizzo69]

lenderfee is meant to be fixed once the project is created