Hard Audit: don't let users borrow from reserves (#827)

* don't borrow from reserves

* use safesub and throw error
This commit is contained in:
Denali Marsh 2021-02-16 15:45:57 +01:00 committed by GitHub
parent 58573e7b26
commit 53eab47c07
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 67 additions and 47 deletions

View File

@ -83,52 +83,54 @@ var (
RegisterCodec = types.RegisterCodec
// variable aliases
BorrowInterestFactorPrefix = types.BorrowInterestFactorPrefix
BorrowedCoinsPrefix = types.BorrowedCoinsPrefix
BorrowsKeyPrefix = types.BorrowsKeyPrefix
DefaultAccumulationTimes = types.DefaultAccumulationTimes
DefaultBorrows = types.DefaultBorrows
DefaultDeposits = types.DefaultDeposits
DefaultMoneyMarkets = types.DefaultMoneyMarkets
DefaultTotalBorrowed = types.DefaultTotalBorrowed
DefaultTotalReserves = types.DefaultTotalReserves
DefaultTotalSupplied = types.DefaultTotalSupplied
DepositsKeyPrefix = types.DepositsKeyPrefix
ErrAccountNotFound = types.ErrAccountNotFound
ErrBorrowEmptyCoins = types.ErrBorrowEmptyCoins
ErrBorrowExceedsAvailableBalance = types.ErrBorrowExceedsAvailableBalance
ErrBorrowNotFound = types.ErrBorrowNotFound
ErrBorrowNotLiquidatable = types.ErrBorrowNotLiquidatable
ErrBorrowedCoinsNotFound = types.ErrBorrowedCoinsNotFound
ErrDepositNotFound = types.ErrDepositNotFound
ErrDepositsNotFound = types.ErrDepositsNotFound
ErrGreaterThanAssetBorrowLimit = types.ErrGreaterThanAssetBorrowLimit
ErrInsufficientBalanceForBorrow = types.ErrInsufficientBalanceForBorrow
ErrInsufficientBalanceForRepay = types.ErrInsufficientBalanceForRepay
ErrInsufficientCoins = types.ErrInsufficientCoins
ErrInsufficientLoanToValue = types.ErrInsufficientLoanToValue
ErrInsufficientModAccountBalance = types.ErrInsufficientModAccountBalance
ErrInvalidAccountType = types.ErrInvalidAccountType
ErrInvalidDepositDenom = types.ErrInvalidDepositDenom
ErrInvalidReceiver = types.ErrInvalidReceiver
ErrInvalidRepaymentDenom = types.ErrInvalidRepaymentDenom
ErrInvalidWithdrawAmount = types.ErrInvalidWithdrawAmount
ErrInvalidWithdrawDenom = types.ErrInvalidWithdrawDenom
ErrMarketNotFound = types.ErrMarketNotFound
ErrMoneyMarketNotFound = types.ErrMoneyMarketNotFound
ErrNegativeBorrowedCoins = types.ErrNegativeBorrowedCoins
ErrNegativeSuppliedCoins = types.ErrNegativeSuppliedCoins
ErrPreviousAccrualTimeNotFound = types.ErrPreviousAccrualTimeNotFound
ErrPriceNotFound = types.ErrPriceNotFound
ErrSuppliedCoinsNotFound = types.ErrSuppliedCoinsNotFound
GovDenom = types.GovDenom
KeyMoneyMarkets = types.KeyMoneyMarkets
ModuleCdc = types.ModuleCdc
MoneyMarketsPrefix = types.MoneyMarketsPrefix
PreviousAccrualTimePrefix = types.PreviousAccrualTimePrefix
SuppliedCoinsPrefix = types.SuppliedCoinsPrefix
SupplyInterestFactorPrefix = types.SupplyInterestFactorPrefix
TotalReservesPrefix = types.TotalReservesPrefix
BorrowInterestFactorPrefix = types.BorrowInterestFactorPrefix
BorrowedCoinsPrefix = types.BorrowedCoinsPrefix
BorrowsKeyPrefix = types.BorrowsKeyPrefix
DefaultAccumulationTimes = types.DefaultAccumulationTimes
DefaultBorrows = types.DefaultBorrows
DefaultDeposits = types.DefaultDeposits
DefaultMoneyMarkets = types.DefaultMoneyMarkets
DefaultTotalBorrowed = types.DefaultTotalBorrowed
DefaultTotalReserves = types.DefaultTotalReserves
DefaultTotalSupplied = types.DefaultTotalSupplied
DepositsKeyPrefix = types.DepositsKeyPrefix
ErrAccountNotFound = types.ErrAccountNotFound
ErrBorrowEmptyCoins = types.ErrBorrowEmptyCoins
ErrBorrowExceedsAvailableBalance = types.ErrBorrowExceedsAvailableBalance
ErrExceedsProtocolBorrowableBalance = types.ErrExceedsProtocolBorrowableBalance
ErrBorrowNotFound = types.ErrBorrowNotFound
ErrBorrowNotLiquidatable = types.ErrBorrowNotLiquidatable
ErrBorrowedCoinsNotFound = types.ErrBorrowedCoinsNotFound
ErrDepositNotFound = types.ErrDepositNotFound
ErrDepositsNotFound = types.ErrDepositsNotFound
ErrGreaterThanAssetBorrowLimit = types.ErrGreaterThanAssetBorrowLimit
ErrInsufficientBalanceForBorrow = types.ErrInsufficientBalanceForBorrow
ErrInsufficientBalanceForRepay = types.ErrInsufficientBalanceForRepay
ErrInsufficientCoins = types.ErrInsufficientCoins
ErrInsufficientLoanToValue = types.ErrInsufficientLoanToValue
ErrInsufficientModAccountBalance = types.ErrInsufficientModAccountBalance
ErrInvalidAccountType = types.ErrInvalidAccountType
ErrInvalidDepositDenom = types.ErrInvalidDepositDenom
ErrInvalidReceiver = types.ErrInvalidReceiver
ErrInvalidRepaymentDenom = types.ErrInvalidRepaymentDenom
ErrInvalidWithdrawAmount = types.ErrInvalidWithdrawAmount
ErrInvalidWithdrawDenom = types.ErrInvalidWithdrawDenom
ErrMarketNotFound = types.ErrMarketNotFound
ErrMoneyMarketNotFound = types.ErrMoneyMarketNotFound
ErrNegativeBorrowedCoins = types.ErrNegativeBorrowedCoins
ErrNegativeSuppliedCoins = types.ErrNegativeSuppliedCoins
ErrPreviousAccrualTimeNotFound = types.ErrPreviousAccrualTimeNotFound
ErrPriceNotFound = types.ErrPriceNotFound
ErrSuppliedCoinsNotFound = types.ErrSuppliedCoinsNotFound
ErrReservesExceedCash = types.ErrReservesExceedCash
GovDenom = types.GovDenom
KeyMoneyMarkets = types.KeyMoneyMarkets
ModuleCdc = types.ModuleCdc
MoneyMarketsPrefix = types.MoneyMarketsPrefix
PreviousAccrualTimePrefix = types.PreviousAccrualTimePrefix
SuppliedCoinsPrefix = types.SuppliedCoinsPrefix
SupplyInterestFactorPrefix = types.SupplyInterestFactorPrefix
TotalReservesPrefix = types.TotalReservesPrefix
)
type (

View File

@ -116,6 +116,20 @@ func (k Keeper) ValidateBorrow(ctx sdk.Context, borrower sdk.AccAddress, amount
return types.ErrBorrowEmptyCoins
}
// The reserve coins aren't available for users to borrow
hardMaccCoins := k.supplyKeeper.GetModuleAccount(ctx, types.ModuleName).GetCoins()
reserveCoins, foundReserveCoins := k.GetTotalReserves(ctx)
if !foundReserveCoins {
reserveCoins = sdk.NewCoins()
}
fundsAvailableToBorrow, isNegative := hardMaccCoins.SafeSub(reserveCoins)
if isNegative {
return sdkerrors.Wrapf(types.ErrReservesExceedCash, "reserves %s > cash %s", reserveCoins, hardMaccCoins)
}
if amount.IsAnyGT(fundsAvailableToBorrow) {
return sdkerrors.Wrapf(types.ErrExceedsProtocolBorrowableBalance, "requested borrow %s > available to borrow %s", amount, fundsAvailableToBorrow)
}
// Get the proposed borrow USD value
moneyMarketCache := map[string]types.MoneyMarket{}
proprosedBorrowUSDValue := sdk.ZeroDec()

View File

@ -220,7 +220,7 @@ func (suite *KeeperTestSuite) TestBorrow() {
},
errArgs{
expectPass: false,
contains: "exceeds module account balance:",
contains: "exceeds borrowable module account balance",
},
},
{

View File

@ -65,4 +65,8 @@ var (
ErrInvalidIndexFactorDenom = sdkerrors.Register(ModuleName, 29, "no index factor found for denom")
// ErrBelowMinimumBorrowValue error for when a proposed borrow position is less than the minimum USD value
ErrBelowMinimumBorrowValue = sdkerrors.Register(ModuleName, 30, "invalid proposed borrow value")
// ErrExceedsProtocolBorrowableBalance for when a requested borrow exceeds the module account's borrowable balance
ErrExceedsProtocolBorrowableBalance = sdkerrors.Register(ModuleName, 31, "exceeds borrowable module account balance")
// ErrReservesExceedCash for when the protocol is insolvent because available reserves exceeds available cash
ErrReservesExceedCash = sdkerrors.Register(ModuleName, 32, "insolvency - protocol reserves exceed available cash")
)