050.md

Low Tangerine Cod

Medium

protocol will not be able to withdraw interestFromExternalProtocolDuringLiquidation

Summary

protocol never claims interestFromExternalProtocolDuringLiquidation

Root Cause

Protocol earn his revenue through liquidation via interestFromExternalProtocolDuringLiquidation

        if (depositDetail.assetName == IBorrowing.AssetName.ETH) {
            treasury.updateInterestFromExternalProtocol(treasury.withdrawFromExternalProtocolDuringLiq(user, index));
        }

Core_logic/borrowLiquidation.sol#L295

    function updateInterestFromExternalProtocol(
        uint256 amount
    ) external onlyCoreContracts {
        interestFromExternalProtocolDuringLiquidation += amount;
    }

This is where protocol claims interest, there is no interestFromExternalProtocolDuringLiquidation`

    function withdrawInterest(
        address toAddress,
        uint256 amount
    ) external onlyOwner {
        require(toAddress != address(0) && amount != 0,"Input address or amount is invalid");
        require(amount <= (totalInterest + totalInterestFromLiquidation),"Treasury don't have enough interest");
        totalInterest -= amount;
        bool sent = usda.transfer(toAddress, amount);
        require(sent, "Failed to send Ether");
    }

Internal pre-conditions

protocol earn totalInterestFromLiquidation

External pre-conditions

none

Attack Path

none, always happening

Impact

interestFromExternalProtocolDuringLiquidation will be stuck in protocol and never claimed

PoC

No response

Mitigation

Remove interestFromExternalProtocolDuringLiquidation from contract and update totalInterest

   function updateInterestFromExternalProtocol(
        uint256 amount
    ) external onlyCoreContracts {
-        interestFromExternalProtocolDuringLiquidation += amount;
+        totalInterest += amount;
    }