# `FlashRolloverLoan_G5` will fail for `LenderCommitmentGroup_Smart` due to `CollateralManager` pulling collateral from `FlashRolloverLoan_G5` Medium · Sherlock · Lending · 23rd April 2024 Finding M-12 of the Teller Finance competition. - Protocol: https://audits.sherlock.xyz/contests/295 - Codebase: https://github.com/0xsimao/2024-04-teller-finance/tree/defe55469a2576735af67483acf31d623e13592d - Source: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/138 --- ## Summary `FlashRolloverLoan_G5` calls `SmartCommitmentForwarder::acceptCommitmentWithRecipient()`, which will have `CollateralManager` commiting tokens from `FlashRolloverLoan_G5`, which will revert as it does not approve it nor have the funds. ## Vulnerability Detail The issue lies in the fact that `FlashRolloverLoan_G5` assumes `SmartCommitmentForwarder` gets the borrower from the [last 20 bytes](https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/FlashRolloverLoan_G5.sol#L303), but it sets the `borrower` to [msg.sender](https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/SmartCommitmentForwarder.sol#L106) instead. Thus, in `SmartCommitmentForwarder::acceptCommitmentWithRecipient()`, `TellerV2::submitBid()` is called with the borrower being `FlashRolloverLoan_G5`, which will end up having the `CollateralManager` [pulling](https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L334-L336) collateral from `FlashRolloverLoan_G5`, which will fail, as it does not deal with this. ## Impact `FlashRolloverLoan_G5` will never work for `LenderCommitmentGroup_Smart` loans. ## Code Snippet https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/FlashRolloverLoan_G5.sol#L303 https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/SmartCommitmentForwarder.sol#L106 ## Tool used Manual Review Vscode ## Recommendation In `FlashRolloverLoan_G5::_acceptCommitment()` pull the collateral from the borrower and approve the `CollateralManager`. --- Related findings: - [Missing documentation for MapleLoan, SetPendingLender and AcceptLender being implemented on MapleLoan but not on LoanManager.](https://0xsimao.com/findings/maple-finance-iii-documentation-pending-accept-implemented): Maple Finance - [Hints on withdrawal may fail as the ICR changes between claiming collateral surplus and repaying debt](https://0xsimao.com/findings/beraborrow-i-hints-withdrawal-collateral-debt): Beraborrow Managed Dens - [In MapleLoanInitializer, the Borrower can choose a different fundsAsset than the lender.](https://0xsimao.com/findings/maple-finance-iii-initializer-borrower-choose-different): Maple Finance - [OstiumTrading::topUpCollateral() is missing pairsStored.groupMaxCollateral(pairIndex) check](https://0xsimao.com/findings/ostium-collateral-pairs-stored-index): Ostium