Mars Protocol Fields of Mars - Mars Protocol

instantiate and update_config functions in contracts/martian-field/src/execute.rs allow contract's owner to update max_ltv, bonus_rate and fee_rate fields with a potential unfair amount. This situation can produce the following consequences:

• A malicious (or compromised) owner can change temporarily max_ltvto very low rate e.g., : 0.01 and bonus_rate to e.g., : 0 and liquidate all positions, draining users assets.
• Owner could mistakenly change max_ltv rate to lower than released one, which could become current positions into “unhealthy” ones and ready to be liquidated.
• If fee_rate is equal to 1, harvest operations will cause unfair reward distributions and owner could drain user assets. Furthermore, if fee_rate is higher than 1 it will cause an overflow.

It is worth noting that likelihood for this to happen is low because martian-field contract is intended to be owned by governance (Council) indefinitely, who is the responsible one for this operation.

Code Location

contracts/martian-field/src/execute.rs

    pub fn update_config(deps: DepsMut, info: MessageInfo, new_config: Config) -> StdResult<Response> {
        let config = CONFIG.load(deps.storage)?;

        if info.sender != config.governance {
            return Err(StdError::generic_err("only governance can update config"));
        }

        CONFIG.save(deps.storage, &new_config)?;

        Ok(Response::default())
    }

contracts/martian-field/src/execute.rs

    pub fn liquidate(
    deps: DepsMut,
    env: Env,
    info: MessageInfo,
    user_addr: Addr,
) -> StdResult<Response> {
    let config = CONFIG.load(deps.storage)?;
    let state = STATE.load(deps.storage)?;
    let position = POSITION.load(deps.storage, &user_addr).unwrap_or_default();

    // position must be active (LTV is not `None`) and the LTV must be greater than `max_ltv`
    let health = compute_health(&deps.querier, &env, &config, &state, &position)?;

    // if `health.ltv` is `Some`, it must be greater than `max_ltv`
    // if `health.ltv` is `None`, indicating the position is already closed, then it is not liquidatable
    let ltv = health.ltv.ok_or_else(|| StdError::generic_err("position is already closed"))?;
    if ltv <= config.max_ltv {
        return Err(StdError::generic_err("position is healthy"));
    }

    // 1. unbond the user's liquidity tokens from Astro generator
    // 2. burn liquidity tokens, withdraw primary + secondary assets from the pool
    // 3. swap all primary assets to secondary assets
    // 4. repay all debts
    // 5. among all remaining assets, send the amount corresponding to `bonus_rate` to the liquidator
    // 6. refund all assets that're left to the user
    //
    // NOTE: in the previous versions, we sell **all** primary assets, which is not optimal because 
    // this will incur bigger slippage, causing worse liquidation cascade, and be potentially lucrative 
    // for sandwich attackers
    //
    // now, we calculate how much additional secondary asset is needed to fully pay off debt, and 
    // reverse-simulate how much primary asset needs to be sold
    //
    // TODO: add slippage checks to the swap step so that liquidation cannot be sandwich attacked
    let callbacks = [
        CallbackMsg::Unbond {
            user_addr: user_addr.clone(),
            bond_units_to_reduce: position.bond_units,
        },
        CallbackMsg::WithdrawLiquidity {
            user_addr: user_addr.clone(),
        },
        CallbackMsg::Cover {
            user_addr: user_addr.clone(),
        },
        CallbackMsg::Repay {
            user_addr: user_addr.clone(),
            repay_amount: health.debt_value,
        },
        CallbackMsg::Refund {
            user_addr: user_addr.clone(),
            recipient_addr: info.sender.clone(),
            percentage: config.bonus_rate,
        },
        CallbackMsg::Refund {
            user_addr: user_addr.clone(),
            recipient_addr: user_addr.clone(),
            percentage: Decimal::one(),
        },
    ];

SOLVED: The issue was fixed in commit 0f9c959931fcde3ddf5cdb1907c9177f69284e31.