# Autonomint audit contest Sherlock · Hedged stablecoin · 4th December 2024 · #1 A public audit contest on Sherlock (hedged stablecoin), completed on 4th December 2024. 0xSimao placed #1. 38 of his findings are published: 26 high severity and 12 medium. ## What Autonomint is Autonomint issues a hedged stablecoin: depositors post collateral and receive downside protection priced as an option, while a counterparty side (dCDS) takes the other half of that trade and earns the option fees, liquidations settling between them. ## Scope The Sherlock competition covered the borrowing and dCDS flows: deposit and withdrawal pricing as collateral recovers, strike-price redemption, fee application between depositor and counterparty, and the two liquidation types. ## High severity findings - [Borrower withdrawing at a loss will cause losses for cds depositors that only withdraw after the price recovers](https://0xsimao.com/findings/autonomint-losses-withdraw-price-recovers) - [Total cds deposited amount is incorrectly modified when cds depositor is at a loss, leading to stuck USDa](https://0xsimao.com/findings/autonomint-deposited-modified-depositor-stuck) - [Cds depositors profit up to the strike price is not redeemable as the total cds deposited amount is not increased](https://0xsimao.com/findings/autonomint-strike-price-redeemable-increased) - [Cds depositor profit is never taxed as the tax is only applied on the option fees](https://0xsimao.com/findings/autonomint-depositor-taxed-applied-fees) - [Type 1 borrower liquidation will incorrectly add cds profit directly to `totalCdsDepositedAmount`](https://0xsimao.com/findings/autonomint-type-liquidation-directly-deposited) - [Liquidation profit is never given to cds depositors who will take these losses](https://0xsimao.com/findings/autonomint-liquidation-profit-depositors-losses) - [`borrowing::withdraw()` at a loss will increase downside protected and misscalculate option fees](https://0xsimao.com/findings/autonomint-withdraw-downside-misscalculate-fees) - [Some liquidated collateral will be locked](https://0xsimao.com/findings/autonomint-liquidated-collateral-locked) - [Cds amounts to reduce from each chain are incorrect and will lead to the inability to withdraw cds in one of the chains](https://0xsimao.com/findings/autonomint-reduce-each-inability-withdraw) - [Potential Underflow in `withdrawInterest`](https://0xsimao.com/findings/autonomint-underflow-withdraw-interest) - [`borrowing::liquidate()` sends the wrong liquidation index to the destination chain, overwritting liquidation information and getting collateral stuck](https://0xsimao.com/findings/autonomint-liquidate-liquidation-index-stuck) - [Malicious user can call `borrowing::calculateCumulativeRate()` any number of times to inflate debt rate as `lastEventTime` is not updated](https://0xsimao.com/findings/autonomint-calculate-times-inflate-debt) - [Late abond holders steal USDa amount from liquidations from earlier abond holders](https://0xsimao.com/findings/autonomint-abond-steal-liquidations-earlier) - [`CDSLib::withdrawUserWhoNotOptedForLiq()` tax is not stored in the treasury](https://0xsimao.com/findings/autonomint-withdraw-opted-liq-stored) - [Using LayerZero for synchronizing global states between two chains may lead to overwriting of global states.](https://0xsimao.com/findings/autonomint-zero-synchronizing-states-overwriting) - [Borrower deposit, withdraw, deposit will reinit `omniChainData.cdsPoolValue`, getting profit stuck for cds depositors](https://0xsimao.com/findings/autonomint-deposit-withdraw-reinit-stuck) - [Missing Update to `omnichain.totalAvailableLiquidationAmount` in `withdrawUser`](https://0xsimao.com/findings/autonomint-omnichain-available-liquidation-withdraw) - [Liquidation will reduce total cds deposited amount, leading to incorrect option fees](https://0xsimao.com/findings/autonomint-liquidation-reduce-option-fees) - [`Borrowing::redeemYields` debits `ABOND` from `msg.sender` but redeems to `user` using `ABOND.State` data from `user`](https://0xsimao.com/findings/autonomint-redeem-yields-debits-redeems) - [The user overpays the USDA amount for downside protection while withdrawing](https://0xsimao.com/findings/autonomint-overpays-usda-downside-protection) - [`totalCdsDepositedAmountWithOptionFees` is incorrectly reduced in `CDSLib::withdrawUser()`, leading to stuck option fees](https://0xsimao.com/findings/autonomint-fees-reduced-withdraw-stuck) - [Strike Price Not Validated Against Strike Percent, Leading to Exploitation Risk](https://0xsimao.com/findings/autonomint-strike-price-percent-exploitation) - [`treasury.updateYieldsFromLiquidatedLrts()` updates the yield in the current chain, but collateral may be in the other chain](https://0xsimao.com/findings/autonomint-yields-lrts-yield-collateral) - [odosAssembledData can be manipulated](https://0xsimao.com/findings/autonomint-odos-assembled-data-manipulated) - [cds owners can withdraw more than expected via manipulating excessProfitCumulativeValue](https://0xsimao.com/findings/autonomint-owners-withdraw-manipulating-excess) - [Malicious users can DOS the protocol by setting downsideProtected to a large value](https://0xsimao.com/findings/autonomint-dos-downside-protected-large) ## Medium severity findings - [Accumulated profit/losses by the cumulative value is not dealt with in `borrowingLiquidation::liquidationType1()`, leading to losses](https://0xsimao.com/findings/autonomint-accumulated-dealt-liquidation-type1) - [Interest generated by last bond will not go to anyone when liquidating as there is no bond amount to collect it](https://0xsimao.com/findings/autonomint-interest-generated-bond-liquidating) - [`GlobalVariables::oftOrCollateralReceiveFromOtherChains()` calculates the fee as if it was the same in both chains, which is false](https://0xsimao.com/findings/autonomint-collateral-calculates-fee-both) - [`GlobalVariables::oftOrCollateralReceiveFromOtherChains()` always charges twice the collateral on `COLLATERAL_TRANSFER`, which is not needed](https://0xsimao.com/findings/autonomint-collateral-charges-transfer-needed) - [Yield form LRTs are forever stuck in the protocol and cannot be withdrawn](https://0xsimao.com/findings/autonomint-yield-form-stuck-withdrawn) - [DOS on liquidation type 1 due to underflow in cds profits computation](https://0xsimao.com/findings/autonomint-dos-liquidation-underflow-computation) - [Protected downside is not updated when `cds.getTotalCdsDepositedAmount() < downsideProtected`](https://0xsimao.com/findings/autonomint-protected-downside-updated-deposited) - [`Treasury.noOfBorrowers` can be set to 0 by looping wei deposit<->withdrawals and DoS withdrawals and reset borrower debt](https://0xsimao.com/findings/autonomint-wei-deposit-withdrawals-debt) - [`CDSLib::calculateCumulativeRate()` incorrectly only increment the local option fees when there are cds deposits](https://0xsimao.com/findings/autonomint-increment-local-fees-deposits) - [Inconsistent Use of `lastCumulativeRate` in `depositTokens()` and `withdraw()` Functions in `Borrowings` Contract](https://0xsimao.com/findings/autonomint-cumulative-deposit-withdraw-borrowings) - [Withdrawing ionic during liquidation has a flaw](https://0xsimao.com/findings/autonomint-withdrawing-ionic-liquidation-flaw) - [An attacker can manipulate `omniChainData.cdsPoolValue` by breaking protocol.](https://0xsimao.com/findings/autonomint-manipulate-omni-data-breaking) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/569)