Malicious users can DOS the protocol by setting downsideProtected to a large value

Summary

In CDS.sol updateDownsideProtected() has no access control so malicious users can set downsideProtected to a large value which will DOS the system.

Root Cause

Because updateDownsideProtected() has no access control malicious users can manipulate the downsideProtected variable which is used in core functions of CDS.sol, causing DOS.

    function updateDownsideProtected(uint128 downsideProtectedAmount) external {
        downsideProtected += downsideProtectedAmount;
    }

https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L829-L831

    function _updateCurrentTotalCdsDepositedAmount() private {
        if (downsideProtected > 0) {
            totalCdsDepositedAmount -= downsideProtected;
            totalCdsDepositedAmountWithOptionFees -= downsideProtected;
            downsideProtected = 0;
        }
    }

https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L833-L839 _updateCurrentTotalCdsDepositedAmount() is used in functions like deposit() and withdraw() so a revert here will DOS users from depositing and withdrawing.

Attack Path

1. Malicious user sets downsideProtected to a large value (greater than totalCdsDepositedAmount)
2. Users calling deposit() or withdraw() will be DOS'ed because a revert will happen in _updateCurrentTotalCdsDepositedAmount() due to underflow.

Impact

Users are DOS'ed from interacting with the protocol so those who deposited have their assets frozen in the contract.

Mitigation

Implement access control to updateDownsideProtected()