# Strike Price Not Validated Against Strike Percent, Leading to Exploitation Risk Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-36 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/1039 --- ### Summary The `strikePrice` and `strikePercent` are important parameters in the [Borrowing::depositTokens](https://github.com/sherlock-audit/2024-11-autonomint/blob/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b/Blockchain/Blockchian/contracts/Core_logic/borrowing.sol#L226) function, which are passed to the `BorrowLib::deposit` function for option fee calculations. As the `strikePercent` increases, from 5% to 25%, the option fees decrease, while the potential for greater gains on `strikePrice` increases. A lower `strikePercent`, such as 5%, has a higher probability of generating returns due to the higher likelihood of ETH moving by 5%. However, there is no validation to ensure that the `strikePrice` is logically consistent with the `strikePercent`. Malicious actors could exploit this by selecting a high `strikePercent` (e.g., 25%), thus paying lower option fees, and simultaneously selecting a low `strikePrice` (e.g., 5%), allowing them to benefit from the lower strike price associated with a smaller strikePercent. This mismatch can result in financial losses for the protocol. ### Root Cause The issue arises from the lack of a validation check to ensure that the `strikePrice` aligns with the chosen `strikePercent`. ### Internal pre-conditions _No response_ ### External pre-conditions The value of the collateral asset must increase by at least given 5% from its deposit value by the time of withdrawal. ### Attack Path 1. Exploiting the missing validation, an attacker selects arbitrary values for `strikePercent` and `strikePrice`, even if they are not logically consistent. 2. The attacker deposits tokens with a high `strikePercent` (e.g., 25%) and selects a low `strikePrice` (e.g., 5% higher than the deposited amount), resulting in low option fees but benefiting from the higher gains that should correspond to a lower `strikePercent`. 3. This combination of a high `strikePercent` and low `strikePrice` allows the attacker to benefit from the returns typically associated with a lower `strikePercent`, causing an unfair advantage and financial losses for the protocol. The strike price gains are [calculated](https://github.com/sherlock-audit/2024-11-autonomint/blob/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b/Blockchain/Blockchian/contracts/lib/BorrowLib.sol#L482) during withdrawal. ### Impact The absence of proper checks allows users to input inconsistent `strikePercent` and `strikePrice` values. This leads to reduced option fees while securing gains that should be restricted to lower `strikePercent` values, causing financial losses to the protocol. It also negatively impacts the calculation of [upsideToDeduct](https://github.com/sherlock-audit/2024-11-autonomint/blob/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b/Blockchain/Blockchian/contracts/Core_logic/Treasury.sol#L259), leading to a lower deduction than intended. ### PoC _No response_ ### Mitigation To prevent exploitation, ensure that the `strikePercent` and `strikePrice` are validated against each other at the time of deposit. The following check can be applied: --- Related findings: - [Major insolvency risk in LiquidationLogic::executeCrossLiquidateERC721() due to not setting a maximum liquidation price](https://0xsimao.com/findings/benddao-insolvency-liquidation-liquidate-erc721): BendDAO