Skip to content
Request an audit

‹ All findings

Type 1 borrower liquidation will incorrectly add cds profit directly to totalCdsDepositedAmount

Crit/HighAutonomint·Sherlock · Hedged stablecoin · 4th December 2024CodebaseH-15

ReportSource

Summary

Borrower liquidations of type 1 add a cds profit component to cds depositors by reducing totalCdsDepositedAmount by a smaller amount of this profit. The problem with this approach is that it will always calculate cumulative values and option fees based on this value, that is bigger than the individual sum of cds depositors, so some values will be left untracked.

Root Cause

In borrowLiquidation.sol:248, omniChainData.totalCdsDepositedAmount is incorrectly reduced by liquidationAmountNeeded - cdsProfits;.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Borrower is liquidated and there is profit.
  2. Profit is added to omniChainData.totalCdsDepositedAmount, which now differs from the individual sum of cds depositors, leading to untracked values, such as the cumulative value from the vault long position or option fees.

Impact

Cumulative value calculations and option fees will be incorrect, as they are divided by a bigger number of cds deposited (which was added the profit), but each cds depositor only has the same deposited amount to multiply by these rates.

PoC

Consider a borrower that deposited 1 ETH at a 1000 USD / ETH price and borrowed 800 USDa. There is 1 cds depositor that deposited 1000 USDa. The price drops 20% and borrowLiquidation::liquidationType1() is called.

  • returnToAbond is (1000 - 800) * 10 / 100 = 20.
  • cdsProfits is 1000 - 800 - 20 = 180.
  • liquidationAmountNeeded is 800 + 20 = 820.
  • cdsAmountToGetFromThisChain is 820 - 180 = 640.
  • omniChainData.totalCdsDepositedAmount is 1000 - (820 - 180) = 360. Now, every cumulative value or option fee is calculated as if there were 360 USDa deposited as cds depositors, but this is not true, as 820 cds will be liquidated and only 180 is left. The profit should be accounted for, but not in this variable.

Mitigation

Do not add the profit to totalCdsDepositedAmount.