CollateralManager#commitCollateral overwrites collateralInfo._amount if called with an existing collateral
When duplicate collateral is committed, the collateral amount is overwritten with the new value. This allows borrowers to front-run bid acceptance to change their collateral and steal from lenders.\\nCollateralManager.sol#L426-L442\\n```\\nfunction _commitCollateral(\\n    uint256 _bidId,\\n    Collateral memory _collateralInfo\\n) internal virtual {\\n    CollateralInfo storage collateral = _bidCollaterals[_bidId];\\n    collateral.collateralAddresses.add(_collateralInfo._collateralAddress);\\n    collateral.collateralInfo[\\n        _collateralInfo._collateralAddress\\n    ] = _collateralInfo; <- @audit-issue collateral info overwritten\\n    emit CollateralCommitted(\\n        _bidId,\\n        _collateralInfo._collateralType,\\n        _collateralInfo._collateralAddress,\\n        _collateralInfo._amount,\\n        _collateralInfo._tokenId\\n    );\\n}\\n```\\n\\nWhen a duplicate collateral is committed it overwrites the collateralInfo for that token, which is used to determine how much collateral to escrow from the borrower.\\nTellerV2.sol#L470-L484\\n```\\nfunction lenderAcceptBid(uint256 _bidId)\\n    external\\n    override\\n    pendingBid(_bidId, "lenderAcceptBid")\\n    whenNotPaused\\n    returns (\\n        uint256 amountToProtocol,\\n        uint256 amountToMarketplace,\\n        uint256 amountToBorrower\\n    )\\n{\\n    // Retrieve bid\\n    Bid storage bid = bids[_bidId];\\n\\n    address sender = _msgSenderForMarket(bid.marketplaceId);\\n```\\n\\nTellerV2#lenderAcceptBid only allows the lender input the bidId of the bid they wish to accept, not allowing them to specify the expected collateral. This allows lenders to be honeypot and front-run causing massive loss of funds:\\nMalicious user creates and commits a bid to take a loan of 10e18 ETH against 100,000e6 USDC with 15% APR\\nLender sees this and calls TellerV2#lenderAcceptBid\\nMalicious user front-runs transaction with commitCollateral call setting USDC to 1\\nBid is filled sending malicious user 10e18 ETH and escrowing 1 USDC\\nAttacker doesn't repay loan and has stolen 10e18 ETH for the price of 1 USDC
Allow lender to specify collateral info and check that it matches the committed addresses and amounts
Bid acceptance can be front-run to cause massive losses to lenders
```\\nfunction _commitCollateral(\\n    uint256 _bidId,\\n    Collateral memory _collateralInfo\\n) internal virtual {\\n    CollateralInfo storage collateral = _bidCollaterals[_bidId];\\n    collateral.collateralAddresses.add(_collateralInfo._collateralAddress);\\n    collateral.collateralInfo[\\n        _collateralInfo._collateralAddress\\n    ] = _collateralInfo; <- @audit-issue collateral info overwritten\\n    emit CollateralCommitted(\\n        _bidId,\\n        _collateralInfo._collateralType,\\n        _collateralInfo._collateralAddress,\\n        _collateralInfo._amount,\\n        _collateralInfo._tokenId\\n    );\\n}\\n```\\n