<!-- canonical: https://0xsimao.com/findings/autonomint-dos-downside-protected-large -->

# Malicious users can DOS the protocol by setting downsideProtected to a large value

Crit/High · Sherlock · Hedged stablecoin · 4th December 2024

Finding H-8 of the Autonomint competition.

- Protocol: https://audits.sherlock.xyz/contests/569
- Report: /reports/autonomint
- Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b
- Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/624

---

### Summary

In CDS.sol updateDownsideProtected() has no access control so malicious users can set downsideProtected to a large value which will DOS the system.

### Root Cause

Because updateDownsideProtected() has no access control malicious users can manipulate the downsideProtected variable which is used in core functions of CDS.sol, causing DOS.
```solidity
    function updateDownsideProtected(uint128 downsideProtectedAmount) external {
        downsideProtected += downsideProtectedAmount;
    }
```
https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L829-L831
```solidity
    function _updateCurrentTotalCdsDepositedAmount() private {
        if (downsideProtected > 0) {
            totalCdsDepositedAmount -= downsideProtected;
            totalCdsDepositedAmountWithOptionFees -= downsideProtected;
            downsideProtected = 0;
        }
    }
```
https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L833-L839
`_updateCurrentTotalCdsDepositedAmount()` is used in functions like deposit() and withdraw() so a revert here will DOS users from depositing and withdrawing.

### Internal pre-conditions

_No response_

### External pre-conditions

_No response_

### Attack Path

1. Malicious user sets downsideProtected to a large value (greater than totalCdsDepositedAmount)
2. Users calling deposit() or withdraw() will be DOS'ed because a revert will happen in `_updateCurrentTotalCdsDepositedAmount()` due to underflow.

### Impact

Users are DOS'ed from interacting with the protocol so those who deposited have their assets frozen in the contract.

### PoC

_No response_

### Mitigation

Implement access control to updateDownsideProtected()

---

Related findings:

- [Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-rewards-duration-harms-little): Exactly Protocol Update - Staking Contract
- [Pool Delegates can steal all the pool's funds by setting a malicious Withdrawal Manager.](https://0xsimao.com/findings/maple-finance-iii-delegates-steal-setting-withdrawal): Maple Finance
- [Setting maxFundingFeePerBlock to a lower value than abs(lastFundingRate) will brick getPendingAccFundingFees()](https://0xsimao.com/findings/ostium-fee-abs-brick-fees): Ostium
- [Tokens with callbacks may allow malicious attackers to steal the protocol](https://0xsimao.com/findings/clip-finance-i-callbacks-malicious-attackers-steal): Clip Finance Strategies