# Accumulated profit/losses by the cumulative value is not dealt with in `borrowingLiquidation::liquidationType1()`, leading to losses Medium · Sherlock · Hedged stablecoin · 4th December 2024 Finding M-19 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/755 --- ### Summary `borrowingLiquidation::liquidationType1()` [reduces](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowLiquidation.sol#L248-L252) `omniChainData.totalVolumeOfBorrowersAmountinWei` and `omniChainData.totalCdsDepositedAmount` without any consideration for the cumulative values so far, leading to losses. The cumulative value at each price is calculated essentially by `priceDiff * omniChainData.totalVolumeOfBorrowersAmountinWei / omniChainData.totalCdsDepositedAmount`, so changing these 2 variables without tracking correctly the cumulative value leads to issues, as shown below. ### Root Cause In `borrowLiquidation.sol:248/252`, `totalCdsDepositedAmount` and `totalVolumeOfBorrowersAmountinWei` are modified without considering the cumulative values. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Consider a starting price of 1000 USD / ETH. 1. Cds deposit of 1000 USDa. 2. Borrow deposit of 1 ETH, borrowing 800 USDa. 3. Price drops to 800 USD / ETH. 4. Borrower deposits 1 wei to trigger cumulative value update, which registers a loss of roughly `1 * (1000 - 800) / 1000 = 0.2`. 5. Liquidation of the first borrower happens, which will reduce `omnichainData.totalCdsDepositAmount` to `360` (800 to treasury + 20 to abond calculated from 10% of 1000 - 800, cds profit of 1000 - 800 - 20 = 180, which yields a final cds deposited amount of 1000 - (800 + 20 - 180) = 360). 6. Cds depositor withdraws the 1000 USDa (disregarding the 1 wei borrower which doesnt really matter but technically would revert due to the 20% ratio), calculating a return amount of `1000 - 1000*0.2 = 800`. [Then](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L664-L665), `uint256 returnAmountWithGains = params.returnAmount + params.cdsDepositDetails.liquidationAmount - params.cdsDepositDetails.initialLiquidationAmount = 800 + 180 - 1000`, which underflows. 180 comes from doing 1000 - 820, where 820 is the liquidation amounted needed (debt + return to abond). ### Impact Cds depositor can never withdraw until the cumulative value recovers. Alternatively, consider that calculating the cumulative value before liquidation yields -0.2, but after liquidating yields -0 (totalVolumeOfBorrowersAmountinWei becomes 0, so the cumulative value loss is 0), which goes to show that effectively it is incorrectly handled. Any user can trigger cumulative value updates before liquidations to force this bug, if needed. ### PoC See the calculations above. ### Mitigation Handle the cumulative values when liquidating.