093.md

Low Tangerine Cod

Medium

CDS liquidators will receive increased rewards at the expense of the treasury

Summary

interest on borrowed amount and fees spend on external protocol not substracted from rewards

Root Cause

According to docs and code, there should be substraction from amount that will be distributed amount cds holders: Br + f:

Since 0.5 ETH is in external protocol so getting back that amount will cost some fees. Suppose that fees is f. Also, we have the interest on borrowed amount i.e br which was not returned So, Total amount returned to dCDS Pool = 1 ETH + 400 USDa - Br -f

But its not implemented in code

        liquidationInfo = CDSInterface.LiquidationInfo(
            liquidationAmountNeeded,
            cdsProfits,
->            depositDetail.depositedAmount,
            omniChainData.totalAvailableLiquidationAmount,
            depositDetail.assetName,
            ((depositDetail.depositedAmount * exchangeRate) / 1 ether)
        );
        ...
                    //Update totalInterest
            omniChainData.totalInterest += borrowerDebt - depositDetail.borrowedAmount;
->         interfaces.treasury.updateTotalInterest(borrowerDebt - depositDetail.borrowedAmount);// total interest will be taken by cds holders

borrowLiquidation.sol#L222

In recommendation I substracted interest and fee from it

Internal pre-conditions

No response

External pre-conditions

none

Attack Path

always happening

Impact

CDS liquidators will receive increased rewards at the expense of the treasury

PoC

No response

Mitigation

/ exchangeRate * 1 ether is to convert to liqudated asset feeFromExternalProtocol should be a constant value set by protocol

        liquidationInfo = CDSInterface.LiquidationInfo(
            liquidationAmountNeeded,
            cdsProfits,
-            depositDetail.depositedAmount,
+            depositDetail.depositedAmount- uint256((borrowerDebt - depositDetail.borrowedAmount) + feeFromExternalProtocol) / exchangeRate * 1 ether,
            omniChainData.totalAvailableLiquidationAmount,
            depositDetail.assetName,
            ((depositDetail.depositedAmount * exchangeRate) / 1 ether)
        );