Small Shamrock Rook
High
Reentrancy in closeLeverageStrategy() can be used to steal a large number of funds from the vault.
In closeLeverageStrategy(), the _collateral token parameter is not enforced to be cNuma or cLst , allowing a maliciously crafted contract to be passed in.
Flashloan repayment can be avoided by re-entering and calling closeLeverageStrategy() with a tiny amount, which updates leverageDebt to a small value.
No response
No response
No response
There are many ways to exploit this to steal vault funds.
One way:
When we bypass the flash loan as explained in 'Root Cause', we force the underlying tokens to be transferred to the cToken. This increases the return value of getCashPrior() which increases the exchange rate.
We can use a flash loan to mint cTokens -> do the exploit (which increases exchange rate) -> then redeem underlying tokens, effectively stealing the flash borrowed funds from the vault.
No response
No response