ChainGuard

lending-protocol (fixture)

Demo Analysis · fixture data

Fixture source · contracts/vulnerable/multi_contract

Potential attack chains

Each chain connects findings through call, state, or oracle dependencies in the repository map. Confidence is derived from how much of the chain's evidence was validated against source, not from model certainty.

CG-001CriticalStrongly supported

Potential oracle takeover leading to over-borrowing

An unprotected price-source setter lets any caller point SpotPriceOracle at a pool they control. LendingVault then values collateral at the attacker-chosen price and lends against it.

Entry point
SpotPriceOracle.setPool()
Steps
8
Evidence verified
8/9
Contracts involved
IPoolSpotPriceOracleLendingVault
Confidence
81%

Impact: LendingVault debt-token balance

CG-002HighModerately supported

Potential cross-function reentrancy enabling borrow against withdrawn collateral

withdrawCollateral hands execution to the caller before reducing collateral. A contract caller can re-enter borrow() and borrow against collateral that is already leaving the vault.

Entry point
LendingVault.withdrawCollateral()
Steps
6
Evidence verified
7/7
Contracts involved
LendingVault
Confidence
74%