# Cds depositors profit up to the strike price is not redeemable as the total cds deposited amount is not increased Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-13 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/743 --- ### Summary Cds depositors get the profit on the eth price increase up to the strike price (5%), and any increase above this threshold goes to the borrowers. However, this amount is never added to the total cds deposited amount, which means that cds depositors can not actually withdraw it as it would underflow. ### Root Cause In `borrowing.sol:667/667`, the upside is not added to `omniChainData.totalCdsDepositedAmount`. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Price increase of a borrower deposit, who withdraws. 2. The upside is not added to the total cds deposited amount, so the cds depositors can not withdraw this profit or it underflows. ### Impact Cds depositors upside is not withdrawable and will underflow. ### PoC [Here](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowing.sol#L665) the upside is not added to the total cds deposited amount, which means that it will underflow when cds depositors withdraw the profit [here](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L713). The profit is added [here](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L343). ### Mitigation Add the upside to `omniChainData.totalCdsDepositedAmount`. --- Related findings: - [Mismatch between yield amount deposited in shares calculation and getAccountYieldBalance()](https://0xsimao.com/findings/benddao-mismatch-yield-deposited-shares): BendDAO