072.md

Low Tangerine Cod

High

totalCdsDepositedAmountWithOptionFees incorrect accounting

Summary

params.optionFees is not being substructed from totalCdsDepositedAmountWithOptionFees like its happening everywhere in the project.

Root Cause

Here protocol doesn't substract params.optionFees like done everywhere in the project https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L731

e.x. here params.returnAmount = cdsDepositDetails.depositedAmount + optionFees https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L885 or like here on the line above it https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L721

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

omniChainData.totalCdsDepositedAmountWithOptionFees and totalCdsDepositedAmountWithOptionFees will be become not in sync which will lead to deposit and withdraw in CDS transactions reverts here. In current implementation from global variable fees substracted from local its not. https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/CDSLib.sol#L72

PoC

No response

Mitigation

fix like this:

-                    totalCdsDepositedAmountWithOptionFees -= (params.cdsDepositDetails.depositedAmount - params.cdsDepositDetails.liquidationAmount + params.optionsFeesToGetFromOtherChain);
+                    totalCdsDepositedAmountWithOptionFees -= (params.cdsDepositDetails.depositedAmount - params.cdsDepositDetails.liquidationAmount + params.optionsFeesToGetFromOtherChain + params.optionFees);

also params.optionsFeesToGetFromOtherChain should be substracted and not added, but its another issue