DenTonylifer - Incentives will not be updated in updateFunds() function

[sherlock-admin2]

DenTonylifer

High

Incentives will not be updated in updateFunds() function

Summary

In matchOffersV3(), the function will fail to update incentives, if there is at least one not-whitelisted pair in isPairWhitelisted[informationOffers[i].principle][collateral];.

Root Cause

Link

Lender can create a lend offer with one principal token and many collaterals, and borrower creates an offer with one collateral and many principals. When borrower's offer matches with many lender's offers, there will many pairs of tokens. If some of this pairs were incentivized, incentives for this pairs should be updated. But, for example, if token from the first index in offers[] and collateral token are not whitelisted pair, then updateFunds() function will return:

for (uint i = 0; i < lenders.length; i++) {
            bool validPair = isPairWhitelisted[informationOffers[i].principle][
                collateral
            ];
            if (!validPair) {
                return;
            }

The issue is other pairs in the array may be whitelisted, but incentives for them will not be updated, causing the borrower and lenders to not receive their incentives.

Internal pre-conditions

Some pairs of tokens were not whitelisted. Since which tokens to use is the choice of the borrower and lender, it's not an admin mistake to not whitelist all existing pairs of tokens.
Moreover, the code clearly expects that some pairs might not be whitelisted:

if (!validPair) {
                return;
            }

So it's ok if some pair are not whitelisted, untill it not prevents whitelisted pairs to update and claim incentive tokens.

External pre-conditions

None.

Attack Path

• Borrower and lenders matches their offers;
• Pair Lender_1 principal -- collateral is not whitelisted for incentives, but other lender's principal are whitelisted with collateral token and should be updated
• But they will not be updated, because first pair was not whitelisted.

Impact

Incentives will not be updated for borrower and lenders, leading to loss of incentive tokens.

PoC

No response

Mitigation

for (uint i = 0; i < lenders.length; i++) {
            bool validPair = isPairWhitelisted[informationOffers[i].principle][
                collateral
            ];
            if (!validPair) {
-                return;
+                continue;
            }