Inability to Override Erroneous Chainalysis Sanction Flag for Borrowers in WildcatMarket.borrow Function

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-wildcat/blob/main/src/market/WildcatMarket.sol#L146-L152

Vulnerability details

Vulnerability Description:

In the WildcatMarket.borrow function, the _isFlaggedByChainalysis(borrower) function is called to check if the borrower has been flagged as a sanctioned entity by Chainalysis. If the borrower is flagged, the transaction is reverted with a BorrowWhileSanctioned error.

However, unlike the case of borrower able to remove the sanctions on lenders who are flagged erroneously as sanctioned entities by chainalysis, the borrower has no ability to override or resolve this flag if it has been set on him erroneously. This creates a potential issue where a borrower erroneously flagged as sanctioned has no way to interact with the market and rectify the situation, effectively locking them out of the protocol.

Impact:

An incorrect Chainalysis flagging can lead to a borrower being permanently barred from borrowing, with no mechanism in place to address or resolve erroneous sanctions. This could result in significant disruptions, particularly if the flagging was done in error, potentially preventing the borrower from accessing or utilizing their own funds.

Proof of Concept (PoC):

In the WildcatMarket.borrow function:

if (_isFlaggedByChainalysis(borrower)) {
    revert_BorrowWhileSanctioned();
}

If the borrower is incorrectly flagged as sanctioned, the transaction is reverted without any mechanism for correction or override.

https://github.com/code-423n4/2024-08-wildcat/blob/main/src/market/WildcatMarket.sol#L146-L152

Recommended Fix:

To address this issue, a mechanism should be implemented that allows an admin or owner of the contract to challenge or override an erroneous sanction flag set on a borrower. This could involve introducing a process where the borrower can request verification to resolve the errorneous sanction flag via an admin account. This would give borrowers a path to resolve erroneous sanction flags and regain access to their borrowing privileges.

Assessed type

Other

[c4-judge]

3docSec changed the severity to QA (Quality Assurance)

[3docSec]

See code-423n4/2024-08-wildcat-validation#310 (comment)

[c4-judge]

3docSec marked the issue as grade-b