<!-- canonical: https://0xsimao.com/findings/autonomint-owners-withdraw-manipulating-excess -->

# cds owners can withdraw more than expected via manipulating excessProfitCumulativeValue

Crit/High · Sherlock · Hedged stablecoin · 4th December 2024

Finding H-5 of the Autonomint competition.

- Protocol: https://audits.sherlock.xyz/contests/569
- Report: /reports/autonomint
- Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b
- Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/469

---

### Summary

`excessProfitCumulativeValue` in withdraw() can be manipulated. Malicious users can manipulate this `excessProfitCumulativeValue` to withdraw more than expected.

### Root Cause

In [CDS.sol:withdraw](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L279), cds owners can withdraw their usda deposit.

In withdraw(), there is one parameter `excessProfitCumulativeValue`, we will use this parameter `excessProfitCumulativeValue` to calculate the cds owner's possible profit. Although this parameter `excessProfitCumulativeValue` is signed by the admin, the signature and `excessProfitCumulativeValue` can be replayed. When different cds owners withdraw, they will get the different `excessProfitCumulativeValue` and `signature` from the protocol's backend server. Malicious users can choose any valid `excessProfitCumulativeValue`, `nonce` and `signature` from on-chain data.

Malicious users can choose one smaller `excessProfitCumulativeValue` to trigger withdraw() function. Malicious users can get more profit than expected.

```solidity
    function withdraw(
        uint64 index, // deposit index.
        uint256 excessProfitCumulativeValue,
        uint256 nonce,
        bytes memory signature
    ) external payable nonReentrant whenNotPaused(IMultiSign.Functions(5)) {
        if (!_verify(FunctionName.CDS_WITHDRAW, excessProfitCumulativeValue, nonce, "0x", signature)) revert CDS_NotAnAdminTwo();
```
```solidity
    function cdsAmountToReturn(
        address _user,
        uint64 index,
        uint128 cumulativeValue,
        bool cumulativeValueSign,
        uint256 excessProfitCumulativeValue
    ) private view returns (uint256) {
    ...
                    uint256 profit = (depositedAmount * (valDiff - excessProfitCumulativeValue)) / 1e11;
    ...
}
```

### Internal pre-conditions

N/A

### External pre-conditions

N/A

### Attack Path

N/A

### Impact

Malicious users can withdraw more profit than expected via manipulating the `excessProfitCumulativeValue` and `signauture`.

### PoC

N/A

### Mitigation

Enhance the signature check. One signature can only be used for one cds owner's specific deposit index.

---

Related findings:

- [_getReserveRatioScalar() will give a lesser value than expected](https://0xsimao.com/findings/mento-ratio-scalar-lesser-expected): Mento
- [`burnSharesToWithdrawEarnings` burns before math, causing the share value to increase](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-share): Teller Finance