# Late abond holders steal USDa amount from liquidations from earlier abond holders Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-22 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/817 --- ### Summary `BorrowLib::redeemYields()` [gets](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/BorrowLib.sol#L996) `usdaToAbondRatioLiq`, which is the amount of USDa gained from liquidations pro-rata to the total supply of abond, at current value without consideration from previous depositors. This means that if some user holds abond and a liquidation happens, other users can mint abond to steal yield from past liquidations. ### Root Cause In `BorrowLib.sol:1002`, there is no consideration from past/next abond holders. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. User deposits and withdraws from `borrowing.sol`, minting abond tokens. 2. User is liquidated via `borrowLiquidation::liquidationType1()`, adding USDa from liquidation. 3. Another user can deposit and withdraw from `borrowing.sol` and steal these USDa, even using a flashloan if necessary. ### Impact Abond holders suffer losses. ### PoC None. ### Mitigation Add a cumulative tracking variable to handle this case. --- Related findings: - [In glAVAX, checking that amount > 0 earlier can save some gas](https://0xsimao.com/findings/glacier-avax-checking-earlier-gas): Glacier