Secondary Big Bang market rates can be manipulated due to not triggering penrose.reAccrueBigBangMarkets(); when leveraging
Secondary market rates can still be manipulated via leverage executors because `penrose.reAccrueBigBangMarkets()` is never called in the leverage module.\\nThe attack described in Tapioca's C4 audit 1561 issue and also described in Spearbit's audit 5.2.16 issue is still possible utilizing the leverage modules.\\nAs a summary, these attacks described a way to manipulate interest rates. As stated in Tapioca's documentation, the interest rate for non-ETH markets is computed considering the current debt in ETH markets. Rate manipulation could be performed by an attacker following these steps:\\nBorrow a huge amount in the ETH market. This step did not accrue the other markets.\\nAccrue other non-ETH markets. It is important to be aware of the fact that non-ETH markets base their interest calculations considering the total debt in the ETH market. After step 1, the attacker triggers an accrual on non-ETH markets which will fetch the data from the greatly increased borrow amount in the ETH market, making the non-ETH market see a huge amount of debt, thus affecting and manipulating the computation of its interest rate.\\nThe fix introduced in the C4 and Spearbit audits incorporated a new function in the Penrose contract to mitigate this issue. If the caller is the `bigBangEthMarket`, then the internal `_reAccrueMarkets()` function will be called, and market's interest rates will be accrued prior to performing any kind of borrow. Following this fix, an attacker can no longer perform step 2 of accruing the markets with a manipulated rate because accrual on secondary markets has already been triggered.\\n```\\n// Penrose.sol\\n\\nfunction reAccrueBigBangMarkets() external notPaused {\\n        if (msg.sender == bigBangEthMarket) {\\n            _reAccrueMarkets(false);\\n        } \\n    }\\n    \\n  function _reAccrueMarkets(bool includeMainMarket) private {\\n      uint256 len = allBigBangMarkets.length;\\n      address[] memory markets = allBigBangMarkets;\\n      for (uint256 i; i < len; i++) {\\n          address market = markets[i];\\n          if (isMarketRegistered[market]) {\\n              if (includeMainMarket || market != bigBangEthMarket) {\\n                  IBigBang(market).accrue();\\n              }\\n          }\\n      }\\n\\n      emit ReaccruedMarkets(includeMainMarket);\\n  }\\n```\\n\\nAlthough this fix is effective, the attack is still possible via Big Bang's leverage modules. Leveraging is a different way of borrowing that still affects a market's total debt. As we can see, the `buyCollateral()` function still performs a `_borrow()`, thus incrementing a market's debt:\\n```\\n// BBLeverage.sol\\n\\nfunction buyCollateral(address from, uint256 borrowAmount, uint256 supplyAmount, bytes calldata data) \\n        external\\n        optionNotPaused(PauseType.LeverageBuy)\\n        solvent(from, false)\\n        notSelf(from)  \\n        returns (uint256 amountOut) \\n    { \\n        // rest of code\\n\\n        \\n        {\\n            (, uint256 borrowShare) = _borrow( \\n                calldata_.from,    \\n                address(this), \\n                calldata_.borrowAmount,\\n                _computeVariableOpeningFee(calldata_.borrowAmount)\\n            );  \\n            (memoryData.borrowShareToAmount,) =\\n                yieldBox.withdraw(assetId, address(this), address(leverageExecutor), 0, borrowShare);\\n        }\\n        \\n        // rest of code\\n       }\\n```\\n\\nBecause Penrose's `reAccrueBigBangMarkets()` function is not called when leveraging, the attack described in the C4 and Spearbit audits is still possible by utilizing leverage to increase the ETH market's total debt, and then accruing non-ETH markets so that rates are manipulated.
It is recommended to trigger Penrose's reAccrueBigBangMarkets() function when interacting with Big Bang's leverage modules, so that the issue can be fully mitigated.
Medium. A previously found issue is still present in the codebase which allows secondary Big Bang markets interest rates to be manipulated, allowing the attacker to perform profitable strategies and potentially affecting users.
```\\n// Penrose.sol\\n\\nfunction reAccrueBigBangMarkets() external notPaused {\\n        if (msg.sender == bigBangEthMarket) {\\n            _reAccrueMarkets(false);\\n        } \\n    }\\n    \\n  function _reAccrueMarkets(bool includeMainMarket) private {\\n      uint256 len = allBigBangMarkets.length;\\n      address[] memory markets = allBigBangMarkets;\\n      for (uint256 i; i < len; i++) {\\n          address market = markets[i];\\n          if (isMarketRegistered[market]) {\\n              if (includeMainMarket || market != bigBangEthMarket) {\\n                  IBigBang(market).accrue();\\n              }\\n          }\\n      }\\n\\n      emit ReaccruedMarkets(includeMainMarket);\\n  }\\n```\\n