Falendar - offer.maxDeadline is used instead of extendedTime when calculating the fee

[sherlock-admin2]

Falendar

High

offer.maxDeadline is used instead of extendedTime when calculating the fee

Summary

The feeOfMaxDeadline formula incorrectly uses offer.maxDeadline, which leads to incorrect fee calculations for loan extensions.

Root Cause

Incorrect use of offer.maxDeadline in the fee calculation formula instead of using extendedTime. offer.maxDeadline represents the loan max deadline, while extendedTime represents the loan duration after the loan extension.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Example scenario:

offer.maxDeadline = 10 days
extendedTime = 5 days
feePerDay = 100 units

Using the incorrect formula with offer.maxDeadline:

offer.maxDeadline = 864000 seconds (10 days)
feeOfMaxDeadline = ((864000 * 100) / 86400);
feeOfMaxDeadline = 1000 units

Using the correct formula with extendedTime:

extendedTime = 432000 seconds (5 days)
feeOfMaxDeadline = ((432000 * 100) / 86400);
feeOfMaxDeadline = 500 units

The user would be overcharged by 500 units if the system uses the wrong formula with offer.maxDeadline.

PoC

No response

Mitigation

Use extendedTime instead of offer.maxDeadline when calculating feeOfMaxDeadline.