# Liquidation profit is never given to cds depositors who will take these losses Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-16 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/750 --- ### Summary Liquidation profit is calculated in `borrowingLiquidation::liquidationType1()`, but is actually never handled and given to cds depositors. It is [stored](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowLiquidation.sol#L221) and added to `totalCdsDepositedAmount`, but it is missing the functionality to send the profits to cds depositors in [CDSLib::withdrawUser()](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L639-L663). ### Root Cause In `CDSLib::withdrawUser()`, the cds profits stored in `omniChainCDSLiqIndexToInfo` are not given to the cds depositors. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Borrower is liquidated, cds profits are calculated but when the cds depositors withdraw, they do not receive these profits. ### Impact Cds depositors take losses on liquidation instead of profiting. ### PoC See the links above. ### Mitigation Calculate the share of the profits and send to the cds depositors.