# Yield form LRTs are forever stuck in the protocol and cannot be withdrawn Medium · Sherlock · Hedged stablecoin · 4th December 2024 Finding M-26 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/818 --- ### Summary During borrower [liquidation](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowLiquidation.sol#L265-L273) (`liquidationType1()`) and [withdrawal from the CDS](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L667-L670), the yield from LRTs is updated and stored in the treasury. ### Root Cause ```solidity File: CDSLib.sol 667: @> interfaces.treasury.updateYieldsFromLiquidatedLrts( // @audit SUBMITTED-HIGH: these funds are stuck forever in the treasury 668: weETHAmount - ((weETHAmountInETHValue * 1 ether) / params.weETH_ExchangeRate) + 669: rsETHAmount - ((rsETHAmountInETHValue * 1 ether) / params.rsETH_ExchangeRate) 670: ); File: borrowLiquidation.sol 265: uint256 yields = depositDetail.depositedAmount - ((depositDetail.depositedAmountInETH * 1 ether) / exchangeRate); 266: 267: // Update treasury data 268: treasury.updateTotalVolumeOfBorrowersAmountinWei(depositDetail.depositedAmountInETH); 269: treasury.updateTotalVolumeOfBorrowersAmountinUSD(depositDetail.depositedAmountUsdValue); 270: treasury.updateDepositedCollateralAmountInWei(depositDetail.assetName, depositDetail.depositedAmountInETH); 271: treasury.updateDepositedCollateralAmountInUsd(depositDetail.assetName, depositDetail.depositedAmountUsdValue); 272: treasury.updateTotalInterestFromLiquidation(totalInterestFromLiquidation); 273: @> treasury.updateYieldsFromLiquidatedLrts(yields); // @audit ??? questionable ``` The problem is that there is no way to for the protocol to retrieve these funds neither is it distributed to users elsewhere ### Internal pre-conditions _No response_ ### External pre-conditions _No response_ ### Attack Path _No response_ ### Impact Yield form LRTs is stuck in the treasury without a way to withdraw them ### PoC _No response_ ### Mitigation Consider inplementing a mechanism to withdraw or distribute this yield --- Related findings: - [Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol](https://0xsimao.com/findings/benddao-unstake-eth-staking-yield): BendDAO - [User to sell the last supply will make the exchange contribution forever stuck](https://0xsimao.com/findings/mento-sell-supply-contribution-stuck): Mento - [Malicious user may frontrun `GoodDollarExpansionController::mintUBIFromReserveBalance()` to make protocol funds stuck](https://0xsimao.com/findings/mento-frontrun-mint-ubi-stuck): Mento - [ERC4626YieldBackend.withdrawMax() silently succeeds when vault is paused, leaving funds stuck](https://0xsimao.com/findings/superfluid-erc4626-yield-paused-stuck): Superfluid Yield Backends