Skip to content
Request an audit

‹ All findings

Total cds deposited amount is incorrectly modified when cds depositor is at a loss, leading to stuck USDa

Crit/HighAutonomint·Sherlock · Hedged stablecoin · 4th December 2024CodebaseH-12

ReportSource

Summary

The total cds deposited amount is decreased by the returned amount when the cds depositor withdraws, which will include any loss that the cds depositor has taken. After the withdrawal, the following cumulative values will be calculated based on this faulty total cds deposited amount and lead to stuck USDa.

Root Cause

In CDSLib.sol:713, params.omniChainData.totalCdsDepositedAmount is decreased by params.cdsDepositDetails.depositedAmount, which includes the loss.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Cds depositors deposit 400 and 600 USDa, respectively, at a price of 1000 USD / ETH.
  2. Borrower deposits 1 ETH at the same 1000 USD / ETH price.
  3. Price drops to 900 USD / ETH.
  4. 400 cds depositor withdraws, calculating a lossy cumulative value of 1 (1000 - 900) / 1000 = 0.1. The return amount is 400 - 400 0.1 = 360. The final total cds deposited amount is 1000 - 360 = 640.
  5. All the cumulative values will be calculated on a total cds deposited amount of 640, but the cds depositor left has 600 deposit amount, so all values will be off. For example, consider that the price goes up to 1000 USD / ETH again, and the cds depositor withdraws. The cumulative value will be increased by 1 (1000 - 900) / 640 = 0.15625, netting -0.1 + 0.15625 = 0.05625, which becomes 600 + 600 0.05625 = 633.75, so 6.25 USDa will be stuck.
  6. Alternatively, if the price drops to 850 USD / ETH, and the borrower withdraws, the final total cds deposited amount will underflow, as the downside protected value is 150, so it becomes 640 - 150 - (600 - 600 (0.1 + 1 (900 - 850) / 640)) = -3.125. Note that if it was divided by 600, instead of 640, it would not underflow and everything would add up, for example.

Impact

Stuck USDa, loss of USDa on withdrawal or DoSed withdrawal, depending on use case.

PoC

See attack path above.

Mitigation

Divide by the correct total cds deposited, such that the sum of individual cds deposited amounts equals the total cds deposited amount.