# `Treasury.noOfBorrowers` can be set to 0 by looping wei deposit<->withdrawals and DoS withdrawals and reset borrower debt Medium · Sherlock · Hedged stablecoin · 4th December 2024 Finding M-30 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/929 --- ### Summary `Treasury.noOfBorrowers` is [increased](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/Treasury.sol#L169) when a user deposits for the first time, as the index is 0. Then, it is [decreased](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/Treasury.sol#L269-L271) when `borrowing[borrower].depositedAmountInETH` becomes 0, which happens when the last deposit of the user is withdrawn. The issue with this approach is that when the same user redeposits, `noOfBorrowers` will not be increased, as `borrowing[user].hasDeposited` is true, but when this same user withdraws, it is decreased. Thus, it's possible to reduce `Treasury.noOfBorrowers` to 0, regardless of the actual number of deposits. ### Root Cause In the `Treasury`, the number of borrowers is increased and decreased in different ways, leading to incorrect behaviour as explained above. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Protocol is working correctly with some cds deposits and borrow deposits. 2. Malicious user loops deposits and withdrawals of very small amounts to reduce `treasury.noOfBorrowers` to 0. 3. Two things will happen: 1) users can not withdraw their borrow deposits, as `treasury.noOfBorrowers` underflows when they try and 2) the debt will be [reset](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/BorrowLib.sol#L240) to 0 even though there are deposits that have accrued debt. ### Impact DoSed withdrawals and debt reset for all borrowers, taking the protocol the loss and users are DoSed. ### PoC None. ### Mitigation Increase and decrease the number of borrowers symmetrically. --- Related findings: - [Null transfers in `IDOPoolAbstract::_depositToTreasury()` could be skipped](https://0xsimao.com/findings/blast-ido-pools-null-transfers-deposit-skipped): Blast IDO Pools - [SpiritVestingFactory::setTreasury() could be 2 factor, as well as the AccessControl OZ contract used in the codebase](https://0xsimao.com/findings/spirit-protocol-vesting-well-access-control): Spirit Protocol - [DoSed withdrawals due to `ManagedLeveragedVault::executeWithdrawalEpoch()` repaying debt above limit](https://0xsimao.com/findings/beraborrow-i-withdrawals-withdrawal-epoch-debt): Beraborrow Managed Dens