# Cds depositor profit is never taxed as the tax is only applied on the option fees Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-14 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/744 --- ### Summary Cds depositor generates [upside](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowing.sol#L665-L667) from borrows up to the strike price increase, but [calculates](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L801) the profit on the difference between the deposited and returned amounts, which only [differ](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L351-L352) by the option fees. ### Root Cause In `CDSLib.sol:801`, the profit should be calculated on the initial deposited amount without considering the extra profit for the price increase. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Price increases 5% since a borrower/cds depositor deposited. 2. Cds depositor withdraws, not paying any tax on the 5% price increase. ### Impact Protocol suffers huge losses by not taxing 10% of the profit. ### PoC See the links above. ### Mitigation Calculated the profit on the price increase since the cds deposit and the option fees.