Skip to content
Request an audit

‹ All findings

Cds depositor profit is never taxed as the tax is only applied on the option fees

Crit/HighAutonomint·Sherlock · Hedged stablecoin · 4th December 2024CodebaseH-14

ReportSource

Summary

Cds depositor generates upside from borrows up to the strike price increase, but calculates the profit on the difference between the deposited and returned amounts, which only differ by the option fees.

Root Cause

In CDSLib.sol:801, the profit should be calculated on the initial deposited amount without considering the extra profit for the price increase.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Price increases 5% since a borrower/cds depositor deposited.
  2. Cds depositor withdraws, not paying any tax on the 5% price increase.

Impact

Protocol suffers huge losses by not taxing 10% of the profit.

PoC

See the links above.

Mitigation

Calculated the profit on the price increase since the cds deposit and the option fees.