Malicious Approved Borrower can remove all other approved borrowers effectively denying access to borrowing

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPair.sol#L307

Vulnerability details

Impact

Detailed description of the impact of this finding.

A malicious approved borrower can call setApprovedBorrowers with _approval==False effectively removing approval for other borrowers which denies them access to borrowAsset, leveragedPosition functions.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Malicious approved borrower calls setApprovedBorrowers with list of _borrowers and _approval==False. A frontrun attack is also possible where the attacker front runs calls to borrowAsset, leveragedPosition functions effectively doing a DOS.

Tools Used

Manual Review

Recommended Mitigation Steps

Restrict access to setApprovedBorrowers by making it an onlyOwner function

[amirnader-ghazvini]

Duplicate of #157

[gititGoro]

Duplicate of #135