Skip to content
Request an audit

‹ All findings

Treasury.noOfBorrowers can be set to 0 by looping wei deposit<->withdrawals and DoS withdrawals and reset borrower debt

MediumAutonomint·Sherlock · Hedged stablecoin · 4th December 2024CodebaseM-30

ReportSource

Summary

Treasury.noOfBorrowers is increased when a user deposits for the first time, as the index is 0. Then, it is decreased when borrowing[borrower].depositedAmountInETH becomes 0, which happens when the last deposit of the user is withdrawn. The issue with this approach is that when the same user redeposits, noOfBorrowers will not be increased, as borrowing[user].hasDeposited is true, but when this same user withdraws, it is decreased. Thus, it's possible to reduce Treasury.noOfBorrowers to 0, regardless of the actual number of deposits.

Root Cause

In the Treasury, the number of borrowers is increased and decreased in different ways, leading to incorrect behaviour as explained above.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Protocol is working correctly with some cds deposits and borrow deposits.
  2. Malicious user loops deposits and withdrawals of very small amounts to reduce treasury.noOfBorrowers to 0.
  3. Two things will happen: 1) users can not withdraw their borrow deposits, as treasury.noOfBorrowers underflows when they try and 2) the debt will be reset to 0 even though there are deposits that have accrued debt.

Impact

DoSed withdrawals and debt reset for all borrowers, taking the protocol the loss and users are DoSed.

PoC

None.

Mitigation

Increase and decrease the number of borrowers symmetrically.