# `CDSLib::calculateCumulativeRate()` incorrectly only increment the local option fees when there are cds deposits Medium · Sherlock · Hedged stablecoin · 4th December 2024 Finding M-32 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/946 --- ### Summary `CDSLib::calculateCumulativeRate()` adds option fees to `_totalCdsDepositedAmountWithOptionFees` if `_totalCdsDepositedAmount` is [not null](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L174-L176), skipping if it is null. The problem is that the 20% ratio of cds pool depositors to borrowers is calculated on the global cds depositors, not the local, so a chain can have 0 cds depositors but still have borrowers depositing and adding option fees. However, these option fees will not be tracked locally and will not be redeemable, underflowing when the other chain tries to fetch the option fees from the local chain. ### Root Cause In `CDSLib.sol:174`, `_totalCdsDepositedAmountWithOptionFees` is skipped summing option fees if total cds depositors in the chain is null. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Cds depositors deposit USDa on chain B. 2. Borrower borrows on chain A, which is possible because the ratio is calculated on the [global](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/BorrowLib.sol#L666-L667) variables. Option fees are not added to `_totalCdsDepositedAmountWithOptionFees`, which remains 0. 3. chain B [fetches](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L90) option fees from chain A when cds depositors on chain B withdraw. 4. option fees are never sent back from chain A to chain B as it underflows in [cds.updateTotalCdsDepositedAmountWithOptionFees()](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/GlobalVariables.sol#L630). As such, these option fees will be stuck. Even if users deposit more in chain A, these option fees will always be stuck. ### Impact Stuck option fees. ### PoC None. ### Mitigation Always add the option fees. --- Related findings: - [`VaultPoolLib::reserve()` will store the `Pa` not attributed to user withdrawals incorrectly and leave in untracked once it expires again](https://0xsimao.com/findings/cork-protocol-attributed-withdrawals-untracked-expires): Cork Protocol - [Yield loss due to StrategyRouterLib:rebalanceStrategies() not allocating saturated strategy deposits](https://0xsimao.com/findings/clip-finance-i-yield-allocating-saturated-deposits): Clip Finance Strategies - [`rewardData.releaseRate` is incorrectly calculated on `RewardsController::config()` when `block.timestamp > start` and `rewardData.lastConfig != rewardData.start`](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-reward-release-rewards-timestamp): Exactly Protocol Update - Staking Contract - [feesAccrued or staker principal may be sent as rewards if rewardRate and emissionEnd are not properly calculated](https://0xsimao.com/findings/metazero-ii-fees-rewards-reward-properly): MetaZero Staking