Skip to content
Request an audit

‹ All findings

Accumulated profit/losses by the cumulative value is not dealt with in borrowingLiquidation::liquidationType1(), leading to losses

MediumAutonomint·Sherlock · Hedged stablecoin · 4th December 2024CodebaseM-19

ReportSource

Summary

borrowingLiquidation::liquidationType1() reduces omniChainData.totalVolumeOfBorrowersAmountinWei and omniChainData.totalCdsDepositedAmount without any consideration for the cumulative values so far, leading to losses. The cumulative value at each price is calculated essentially by priceDiff * omniChainData.totalVolumeOfBorrowersAmountinWei / omniChainData.totalCdsDepositedAmount, so changing these 2 variables without tracking correctly the cumulative value leads to issues, as shown below.

Root Cause

In borrowLiquidation.sol:248/252, totalCdsDepositedAmount and totalVolumeOfBorrowersAmountinWei are modified without considering the cumulative values.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Consider a starting price of 1000 USD / ETH.
  2. Cds deposit of 1000 USDa.
  3. Borrow deposit of 1 ETH, borrowing 800 USDa.
  4. Price drops to 800 USD / ETH.
  5. Borrower deposits 1 wei to trigger cumulative value update, which registers a loss of roughly 1 * (1000 - 800) / 1000 = 0.2.
  6. Liquidation of the first borrower happens, which will reduce omnichainData.totalCdsDepositAmount to 360 (800 to treasury + 20 to abond calculated from 10% of 1000 - 800, cds profit of 1000 - 800 - 20 = 180, which yields a final cds deposited amount of 1000 - (800 + 20 - 180) = 360).
  7. Cds depositor withdraws the 1000 USDa (disregarding the 1 wei borrower which doesnt really matter but technically would revert due to the 20% ratio), calculating a return amount of 1000 - 1000*0.2 = 800. Then, uint256 returnAmountWithGains = params.returnAmount + params.cdsDepositDetails.liquidationAmount - params.cdsDepositDetails.initialLiquidationAmount = 800 + 180 - 1000, which underflows. 180 comes from doing 1000 - 820, where 820 is the liquidation amounted needed (debt + return to abond).

Impact

Cds depositor can never withdraw until the cumulative value recovers. Alternatively, consider that calculating the cumulative value before liquidation yields -0.2, but after liquidating yields -0 (totalVolumeOfBorrowersAmountinWei becomes 0, so the cumulative value loss is 0), which goes to show that effectively it is incorrectly handled. Any user can trigger cumulative value updates before liquidations to force this bug, if needed.

PoC

See the calculations above.

Mitigation

Handle the cumulative values when liquidating.