DeFi 借貸協議 Cream finance 遭駭事件分析

# 事件簡介

2021 年 10 月 27 日，借貸協議 Cream fiancne 遭到閃電貸攻擊，損失高達 1.3 億美金。

twitter

# 漏洞分析

在借款時主要會被呼叫到的函式為 borrowFresh，在開頭就會先檢查是否符合借款資格：

function borrowFresh(
        address payable borrower,
        uint256 borrowAmount,
        bool isNative
    ) internal returns (uint256) {
        /* Fail if borrow not allowed */
        require(comptroller.borrowAllowed(address(this), borrower, borrowAmount) == 0, "comptroller rejection");
        // ...
}

在 borrowAllowed 中，會再呼叫另一個函式 getHypotheticalAccountLiquidityInternal：

/**
 * @notice Checks if the account should be allowed to borrow the underlying asset of the given market
 * @param cToken The market to verify the borrow against
 * @param borrower The account which would borrow the asset
 * @param borrowAmount The amount of underlying the account would borrow
 * @return 0 if the borrow is allowed, otherwise a semi-opaque error code (See ErrorReporter.sol)
 */
function borrowAllowed(
    address cToken,
    address borrower,
    uint256 borrowAmount
) external returns (uint256) {
    // Pausing is a very serious situation - we revert to sound the alarms
    require(!borrowGuardianPaused[cToken], "borrow is paused");

    require(isMarketListed(cToken), "market not listed");

    if (!markets[cToken].accountMembership[borrower]) {
        // only cTokens may call borrowAllowed if borrower not in market
        require(msg.sender == cToken, "sender must be cToken");

        // attempt to add borrower to the market
        require(addToMarketInternal(CToken(msg.sender), borrower) == Error.NO_ERROR, "failed to add market");

        // it should be impossible to break the important invariant
        assert(markets[cToken].accountMembership[borrower]);
    }

    require(oracle.getUnderlyingPrice(CToken(cToken)) != 0, "price error");

    uint256 borrowCap = borrowCaps[cToken];
    // Borrow cap of 0 corresponds to unlimited borrowing
    if (borrowCap != 0) {
        uint256 totalBorrows = CToken(cToken).totalBorrows();
        uint256 nextTotalBorrows = add_(totalBorrows, borrowAmount);
        require(nextTotalBorrows < borrowCap, "market borrow cap reached");
    }

    (Error err, , uint256 shortfall) = getHypotheticalAccountLiquidityInternal(
        borrower,
        CToken(cToken),
        0,
        borrowAmount
    );
    require(err == Error.NO_ERROR, "failed to get account liquidity");
    require(shortfall == 0, "insufficient liquidity");

    return uint256(Error.NO_ERROR);
}

而在 getHypotheticalAccountLiquidityInternal 裡面，會呼叫 oracle.getUnderlyingPrice(asset); 來取得價格，getUnderlyingPrice 的實作如下：

/**
 * @notice Get the underlying price of a listed cToken asset
 * @param cToken The cToken to get the underlying price of
 * @return The underlying asset price mantissa (scaled by 1e18)
 */
function getUnderlyingPrice(CToken cToken) public view returns (uint256) {
    address cTokenAddress = address(cToken);
    if (cTokenAddress == cEthAddress) {
        // ether always worth 1
        return 1e18;
    } else if (cTokenAddress == crXSushiAddress) {
        // Handle xSUSHI.
        uint256 exchangeRate = XSushiExchangeRateInterface(xSushiExRateAddress).getExchangeRate();
        return mul_(getTokenPrice(sushiAddress), Exp({mantissa: exchangeRate}));
    }

    address underlying = CErc20(cTokenAddress).underlying();

    // Handle LP tokens.
    if (isUnderlyingLP[underlying]) {
        return getLPFairPrice(underlying);
    }

    // Handle Yvault tokens.
    if (yvTokens[underlying].isYvToken) {
        return getYvTokenPrice(underlying);
    }

    // Handle curve pool tokens.
    if (crvTokens[underlying].isCrvToken) {
        return getCrvTokenPrice(underlying);
    }

    return getTokenPrice(underlying);
}

接著我們來看 getYvTokenPrice：

/**
 * @notice Get price for Yvault tokens
 * @param token The Yvault token
 * @return The price
 */
function getYvTokenPrice(address token) internal view returns (uint256) {
    YvTokenInfo memory yvTokenInfo = yvTokens[token];
    require(yvTokenInfo.isYvToken, "not a Yvault token");

    uint256 pricePerShare;
    address underlying;
    if (yvTokenInfo.version == YvTokenVersion.V1) {
        pricePerShare = YVaultV1Interface(token).getPricePerFullShare();
        underlying = YVaultV1Interface(token).token();
    } else {
        pricePerShare = YVaultV2Interface(token).pricePerShare();
        underlying = YVaultV2Interface(token).token();
    }

    uint256 underlyingPrice;
    if (crvTokens[underlying].isCrvToken) {
        underlyingPrice = getCrvTokenPrice(underlying);
    } else {
        underlyingPrice = getTokenPrice(underlying);
    }
    return mul_(underlyingPrice, Exp({mantissa: pricePerShare}));
}