# Type 1 borrower liquidation will incorrectly add cds profit directly to `totalCdsDepositedAmount` Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-15 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/746 --- ### Summary Borrower liquidations of type 1 add a cds profit component to cds depositors by [reducing](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowLiquidation.sol#L248) `totalCdsDepositedAmount` by a smaller amount of this profit. The problem with this approach is that it will always calculate cumulative values and option fees based on this value, that is bigger than the individual sum of cds depositors, so some values will be left untracked. ### Root Cause In `borrowLiquidation.sol:248`, `omniChainData.totalCdsDepositedAmount` is incorrectly reduced by `liquidationAmountNeeded - cdsProfits;`. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Borrower is liquidated and there is profit. 2. Profit is added to `omniChainData.totalCdsDepositedAmount`, which now differs from the individual sum of cds depositors, leading to untracked values, such as the cumulative value from the vault long position or option fees. ### Impact Cumulative value calculations and option fees will be incorrect, as they are divided by a bigger number of cds deposited (which was added the profit), but each cds depositor only has the same deposited amount to multiply by these rates. ### PoC Consider a borrower that deposited 1 ETH at a 1000 USD / ETH price and borrowed 800 USDa. There is 1 cds depositor that deposited 1000 USDa. The price drops 20% and `borrowLiquidation::liquidationType1()` is called. - `returnToAbond` is `(1000 - 800) * 10 / 100 = 20`. - `cdsProfits` is `1000 - 800 - 20 = 180`. - `liquidationAmountNeeded` is `800 + 20 = 820`. - `cdsAmountToGetFromThisChain` is `820 - 180 = 640`. - `omniChainData.totalCdsDepositedAmount` is `1000 - (820 - 180) = 360`. Now, every cumulative value or option fee is calculated as if there were 360 USDa deposited as cds depositors, but this is not true, as 820 cds will be liquidated and only 180 is left. The profit should be accounted for, but not in this variable. ### Mitigation Do not add the profit to `totalCdsDepositedAmount`. --- Related findings: - [Mismatch between yield amount deposited in shares calculation and getAccountYieldBalance()](https://0xsimao.com/findings/benddao-mismatch-yield-deposited-shares): BendDAO - [_addLiquidity() slippage is incorrectly set](https://0xsimao.com/findings/singularity-add-liquidity-slippage-incorrectly): Singularity