lending-protocol (fixture)

Demo Analysis. These results are pre-recorded fixture data for the intentionally vulnerable contracts in contracts/vulnerable. They were not produced by a live run.

Potential attack chains

4 of 8 findings connect into a chain.

Potential findings

3 High
4 Medium
1 Informational

Isolated findings

1 unverified · 0 related

Attack chains

View all findings

CG-001CriticalStrongly supported

Potential oracle takeover leading to over-borrowing

An unprotected price-source setter lets any caller point SpotPriceOracle at a pool they control. LendingVault then values collateral at the attacker-chosen price and lends against it.

Entry point: SpotPriceOracle.setPool()
Steps: 8
Evidence verified: 8/9
Contracts involved: IPoolSpotPriceOracleLendingVault
Confidence: 81%

CG-002HighModerately supported

Potential cross-function reentrancy enabling borrow against withdrawn collateral

withdrawCollateral hands execution to the caller before reducing collateral. A contract caller can re-enter borrow() and borrow against collateral that is already leaving the vault.

Entry point: LendingVault.withdrawCollateral()
Steps: 6
Evidence verified: 7/7
Contracts involved: LendingVault
Confidence: 74%

Investigation summary

Attack chains