# `CDSLib::withdrawUserWhoNotOptedForLiq()` tax is not stored in the treasury Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-23 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/829 --- ### Summary `CDSLib::withdrawUserWhoNotOptedForLiq()` does [not](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L891) store the tax from the cds depositor profit, leaving these funds stuck. It must call `Treasury::updateUsdaCollectedFromCdsWithdraw()`, similarly to what is done [when](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L803) the user opts in for liquidation. ### Root Cause In `CDSLib::withdrawUserWhoNotOptedForLiq()`, the profit tax is not stored in the treasury. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Cds depositor who did not opt in for liquidation withdraws, and the profit tax to the protocol is not stored and gets stuck. ### Impact Stuck funds. ### PoC None. ### Mitigation Call `Treasury::updateUsdaCollectedFromCdsWithdraw()` on the profit. --- Related findings: - [Withdraw requests could be stored in a simpler way in glAVAX](https://0xsimao.com/findings/glacier-withdraw-stored-simpler-way): Glacier - [A malicious user may unlock instantly all the funds from the `FluidLocker` when no one is staking in the Tax pool](https://0xsimao.com/findings/superfluid-locker-system-unlock-instantly-staking-tax): Superfluid Locker System - [`VaultPoolLib::reserve()` will store the `Pa` not attributed to user withdrawals incorrectly and leave in untracked once it expires again](https://0xsimao.com/findings/cork-protocol-attributed-withdrawals-untracked-expires): Cork Protocol - [Admin new issuance or user calling `Vault::redeemExpiredLv()` after `Psm::redeemWithCt()` will lead to stuck funds when trying to withdraw](https://0xsimao.com/findings/cork-protocol-issuance-redeem-stuck-withdraw): Cork Protocol