# Teller Finance audit contest Sherlock · Lending · 23rd April 2024 · #3 A public audit contest on Sherlock (lending), completed on 23rd April 2024. 0xSimao placed #3. 17 of his findings are published: 7 high severity and 10 medium. ## What Teller Finance is Teller is a non-custodial lending book that enables time-based loans. The protocol supports any ERC-20 token or ERC-721 / ERC-1155 NFT as collateral, with no margin liquidations for the duration of a loan. Teller is live on Ethereum, Base, Arbitrum and Polygon. ## Scope The TellerV2 lending book: bids and repayments, the lender commitment forwarder, collateral escrow and the market registry. ## High severity findings - [`_sendOrEscrowFunds` will brick LCG funds causing insolvency](https://0xsimao.com/findings/teller-finance-escrow-lcg-causing-insolvency) - [`burnSharesToWithdrawEarnings` burns before math, causing the share value to increase](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-share) - [liquidateDefaultedLoanWithIncentive sends the collateral to the wrong account](https://0xsimao.com/findings/teller-finance-liquidate-defaulted-incentive-collateral) - [Anyone can steal pool shares from lender group if no-revert-on-failure tokens are used](https://0xsimao.com/findings/teller-finance-steal-shares-revert-failure) - [Drained lender due to `LenderCommitmentGroup_Smart::acceptFundsForAcceptBid()` `_collateralAmount` by `STANDARD_EXPANSION_FACTOR` multiplication](https://0xsimao.com/findings/teller-finance-bid-collateral-factor-multiplication) - [`LenderCommitmentGroup_Smart` picks the wrong Uniswap price, allowing borrowing at a discount by swapping before withdrawing](https://0xsimao.com/findings/teller-finance-picks-uniswap-price-allowing) - [Interest rate in `LenderCommitmentGroup_Smart` may be easily manipulated by depositing, taking a loan and withdrawing](https://0xsimao.com/findings/teller-finance-interest-easily-manipulated-taking) ## Medium severity findings - [Issue #497 'Add parameter to lender accept bid for MaxMarketFee' from previous audit is still present](https://0xsimao.com/findings/teller-finance-497-bid-fee-audit) - [Incorrect selector in `FlashRolloverLoan_G5::_acceptCommitment()` does not match `SmartCommitmentForwarder::acceptCommitmentWithRecipient()`](https://0xsimao.com/findings/teller-finance-rollover-match-forwarder-recipient) - [`FlashRolloverLoan_G5` will fail for `LenderCommitmentGroup_Smart` due to `CollateralManager` pulling collateral from `FlashRolloverLoan_G5`](https://0xsimao.com/findings/teller-finance-flash-rollover-collateral-pulling) - [`FlashRolloverLoan_G5` will not work for certain tokens due to not setting the approval to `0` after repaying a loan](https://0xsimao.com/findings/teller-finance-flash-rollover-approval-repaying) - [Performing a direct multiplication in `_getPriceFromSqrtX96` will overflow for some uniswap pools](https://0xsimao.com/findings/teller-finance-performing-price-overflow-uniswap) - [Missing `__Ownable_init()` call in `LenderCommitmentGroup_Smart::initialize()`](https://0xsimao.com/findings/teller-finance-ownable-init-commitment-initialize) - [`LenderCommitmentGroup_Smart` does not use `mulDiv` when converting between token and share amounts, possibly leading to DoS or loss of funds](https://0xsimao.com/findings/teller-finance-mul-div-converting-share) - [`LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-slippage) - [APRs are lower than they should](https://0xsimao.com/findings/teller-finance-lower-they) - [`LenderCommitmentGroup` pools will have incorrect exchange rate when fee-on-transfer tokens are used](https://0xsimao.com/findings/teller-finance-pools-exchange-fee-transfer) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/295)