<!-- canonical: https://0xsimao.com/findings/teller-finance-rollover-match-forwarder-recipient -->

# Incorrect selector in `FlashRolloverLoan_G5::_acceptCommitment()` does not match `SmartCommitmentForwarder::acceptCommitmentWithRecipient()`

Medium · Sherlock · Lending · 23rd April 2024

Finding M-11 of the Teller Finance competition.

- Protocol: https://audits.sherlock.xyz/contests/295
- Codebase: https://github.com/0xsimao/2024-04-teller-finance/tree/defe55469a2576735af67483acf31d623e13592d
- Source: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/135

---

## Summary

`FlashRolloverLoan_G5::_acceptCommitment()` allows picking the `SmartCommitmentForwarder`, but the selector is incorrect, making it unusable for `LenderCommitmentGroup_Smart`.

## Vulnerability Detail

`FlashRolloverLoan_G5::_acceptCommitment()` accepts the commitment to `SmartCommitmentForwarder` if `_commitmentArgs.smartCommitmentAddress != address(0)`. However, the selector used is `acceptSmartCommitmentWithRecipient()`, which does not match `SmartCommitmentForwarder::acceptCommitmentWithRecipient()`, DoSing the ability to rollover loans for `LenderCommitmentGroup_Smart`.

## Impact

`FlashRolloverLoan_G5` will not work for `LenderCommitmentGroup_Smart` loans.

## Code Snippet

[FlashRolloverLoan_G5::_acceptCommitment()](https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/FlashRolloverLoan_G5.sol#L292)
```solidity
function _acceptCommitment(
    address lenderCommitmentForwarder,
    address borrower,
    address principalToken,
    AcceptCommitmentArgs memory _commitmentArgs
)
    internal
    virtual
    returns (uint256 bidId_, uint256 acceptCommitmentAmount_)
{
    uint256 fundsBeforeAcceptCommitment = IERC20Upgradeable(principalToken)
        .balanceOf(address(this));


    if (_commitmentArgs.smartCommitmentAddress != address(0)) {

            bytes memory responseData = address(lenderCommitmentForwarder)
                .functionCall(
                    abi.encodePacked(
                        abi.encodeWithSelector(
                            ISmartCommitmentForwarder
                                .acceptSmartCommitmentWithRecipient
                                .selector,
                            _commitmentArgs.smartCommitmentAddress,
                            _commitmentArgs.principalAmount,
                            _commitmentArgs.collateralAmount,
                            _commitmentArgs.collateralTokenId,
                            _commitmentArgs.collateralTokenAddress,
                            address(this),
                            _commitmentArgs.interestRate,
                            _commitmentArgs.loanDuration
                        ),
                        borrower //cant be msg.sender because of the flash flow
                    )
                );

            (bidId_) = abi.decode(responseData, (uint256));
        ... 
```

## Tool used

Manual Review

Vscode

## Recommendation

Insert the correct selector, `SmartCommitmentForwarder::acceptCommitmentWithRecipient()`.

---

Related findings:

- [Missing documentation for MapleLoan, SetPendingLender and AcceptLender being implemented on MapleLoan but not on LoanManager.](https://0xsimao.com/findings/maple-finance-iii-documentation-pending-accept-implemented): Maple Finance
- [FlashSwapRouter::emptyReserve()  and FlashSwapROuter::emptyReservePartial() functions return incorrect values](https://0xsimao.com/findings/cork-protocol-flash-empty-outer-partial): Cork Protocol