Teller Finance audit contest

A public audit contest on Sherlock (lending), completed on 23rd April 2024. 0xSimao placed #3. 17 of his findings are published: 7 high severity and 10 medium.

What Teller Finance is

Teller is a non-custodial lending book that enables time-based loans. The protocol supports any ERC-20 token or ERC-721 / ERC-1155 NFT as collateral, with no margin liquidations for the duration of a loan. Teller is live on Ethereum, Base, Arbitrum and Polygon.

Scope

The TellerV2 lending book: bids and repayments, the lender commitment forwarder, collateral escrow and the market registry.

High severity findings

• _sendOrEscrowFunds will brick LCG funds causing insolvency
• burnSharesToWithdrawEarnings burns before math, causing the share value to increase
• liquidateDefaultedLoanWithIncentive sends the collateral to the wrong account
• Anyone can steal pool shares from lender group if no-revert-on-failure tokens are used
• Drained lender due to LenderCommitmentGroup_Smart::acceptFundsForAcceptBid() _collateralAmount by STANDARD_EXPANSION_FACTOR multiplication
• LenderCommitmentGroup_Smart picks the wrong Uniswap price, allowing borrowing at a discount by swapping before withdrawing
• Interest rate in LenderCommitmentGroup_Smart may be easily manipulated by depositing, taking a loan and withdrawing

Medium severity findings

• Issue #497 'Add parameter to lender accept bid for MaxMarketFee' from previous audit is still present
• Incorrect selector in FlashRolloverLoan_G5::_acceptCommitment() does not match SmartCommitmentForwarder::acceptCommitmentWithRecipient()
• FlashRolloverLoan_G5 will fail for LenderCommitmentGroup_Smart due to CollateralManager pulling collateral from FlashRolloverLoan_G5
• FlashRolloverLoan_G5 will not work for certain tokens due to not setting the approval to 0 after repaying a loan
• Performing a direct multiplication in _getPriceFromSqrtX96 will overflow for some uniswap pools
• Missing __Ownable_init() call in LenderCommitmentGroup_Smart::initialize()
• LenderCommitmentGroup_Smart does not use mulDiv when converting between token and share amounts, possibly leading to DoS or loss of funds
• LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings() are vulnerable to slippage attacks
• APRs are lower than they should
• LenderCommitmentGroup pools will have incorrect exchange rate when fee-on-transfer tokens are used

The contest

View the contest page