Skip to content
Request an audit

‹ All findings

Liquidation will reduce total cds deposited amount, leading to incorrect option fees

Crit/HighAutonomint·Sherlock · Hedged stablecoin · 4th December 2024CodebaseH-29

ReportSource

Summary

borrowLiquidation::liquidationType1() reduces omniChainData.totalCdsDepositedAmount, so the option fees will be calculated on this reduced total cds depositors, but the normalized deposit of each borrower still amounts to their initial value, overcharging option fees.

Root Cause

In borrowLiquidation:248, the omniChainData.totalCdsDepositedAmount is reduced, but the option fees normalized deposits are not accounted for.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. ETH price is 1000 USD / ETH.
  2. Cds depositor deposits 1000 USDa.
  3. Borrower deposits 1 ETH and borrows 800 USDa. Assume no option fees are charged.
  4. Price drops to 800 USD / ETH.

At this point, the total normalized amount of the cds depositor is 1000 (1000 USda divided by 1 rate).

  1. Borrower is liquidated and omniChainData.totalCdsDepositedAmount becomes 360 (1000 - (800 + 20 - 180), where 800 is the debt, 20 is the amount to return to abond and 180 is the cds profits).
  2. New borrower deposits and pays 50 USD option fees. CDS::calculateCumulativeRate() calculates percentageChange as 50 / 360. The new rate becomes 1 * (1 + 50 / 360) = 1.1389.
  3. Borrower withdraws.
  4. Cds depositor withdraws, getting from option fees 1000 * 1.1389 - 1000 = 138.9, way more than it should.

Impact

Cds depositor gets much more option fees than it should.

PoC

See above.

Mitigation

Adjust the cumulative rate when reducing the cds deposited amount with option fees or similar.