049.md

Low Tangerine Cod

Medium

protocol will not be able to withdraw totalInterestFromLiquidation

Summary

Underflow in withdrawInterest function will allow to withdraw Interest From Liquidation earned by protocol

Root Cause

Protocol earns his part of revenue through totalInterestFromLiquidation and totalInterest as we can see from function below. But when protocol deicide to withdraw all his revenue by passing amount=totalInterest + totalInterestFromLiquidation there will be under in totalInterest -= amount totalInterest -= totalInterest + totalInterestFromLiquidation which mean he will never be able to claim it

    function withdrawInterest(
        address toAddress,
        uint256 amount
    ) external onlyOwner {
        require(toAddress != address(0) && amount != 0,"Input address or amount is invalid");
        require(amount <= (totalInterest + totalInterestFromLiquidation),"Treasury don't have enough interest");
        totalInterest -= amount;
        bool sent = usda.transfer(toAddress, amount);
        require(sent, "Failed to send Ether");
    }

Blockchian/contracts/Core_logic/Treasury.sol#L621

Internal pre-conditions

protocol earn totalInterestFromLiquidation

External pre-conditions

none

Attack Path

None, always happens by itself

Impact

protocol will lose revenue via totalInterestFromLiquidation

PoC

not needed

Mitigation

Remove totalInterestFromLiquidation from contract and update totalInterest

    function updateTotalInterestFromLiquidation(
        uint256 amount
    ) external onlyCoreContracts {
-        totalInterestFromLiquidation += amount;
+        totalInterest += amount;
    }

    function withdrawInterest(
        address toAddress,
        uint256 amount
    ) external onlyOwner {
        require(toAddress != address(0) && amount != 0,"Input address or amount is invalid");
-        require(amount <= (totalInterest + totalInterestFromLiquidation),"Treasury don't have enough interest");
+        require(amount <= (totalInterest),"Treasury don't have enough interest");
        totalInterest -= amount;
        bool sent = usda.transfer(toAddress, amount);
        require(sent, "Failed to send Ether");
    }