Skip to content
Request an audit

‹ All findings

CDSLib::calculateCumulativeRate() incorrectly only increment the local option fees when there are cds deposits

MediumAutonomint·Sherlock · Hedged stablecoin · 4th December 2024CodebaseM-32

ReportSource

Summary

CDSLib::calculateCumulativeRate() adds option fees to _totalCdsDepositedAmountWithOptionFees if _totalCdsDepositedAmount is not null, skipping if it is null.

The problem is that the 20% ratio of cds pool depositors to borrowers is calculated on the global cds depositors, not the local, so a chain can have 0 cds depositors but still have borrowers depositing and adding option fees. However, these option fees will not be tracked locally and will not be redeemable, underflowing when the other chain tries to fetch the option fees from the local chain.

Root Cause

In CDSLib.sol:174, _totalCdsDepositedAmountWithOptionFees is skipped summing option fees if total cds depositors in the chain is null.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Cds depositors deposit USDa on chain B.
  2. Borrower borrows on chain A, which is possible because the ratio is calculated on the global variables. Option fees are not added to _totalCdsDepositedAmountWithOptionFees, which remains 0.
  3. chain B fetches option fees from chain A when cds depositors on chain B withdraw.
  4. option fees are never sent back from chain A to chain B as it underflows in cds.updateTotalCdsDepositedAmountWithOptionFees(). As such, these option fees will be stuck. Even if users deposit more in chain A, these option fees will always be stuck.

Impact

Stuck option fees.

PoC

None.

Mitigation

Always add the option fees.