Late abond holders steal USDa amount from liquidations from earlier abond holders

Summary

BorrowLib::redeemYields() gets usdaToAbondRatioLiq, which is the amount of USDa gained from liquidations pro-rata to the total supply of abond, at current value without consideration from previous depositors. This means that if some user holds abond and a liquidation happens, other users can mint abond to steal yield from past liquidations.

Root Cause

In BorrowLib.sol:1002, there is no consideration from past/next abond holders.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

1. User deposits and withdraws from borrowing.sol, minting abond tokens.
2. User is liquidated via borrowLiquidation::liquidationType1(), adding USDa from liquidation.
3. Another user can deposit and withdraw from borrowing.sol and steal these USDa, even using a flashloan if necessary.

Impact

Abond holders suffer losses.

PoC

None.

Mitigation

Add a cumulative tracking variable to handle this case.