097.md

Low Tangerine Cod

High

vault value is not being changed on liquidation

Summary

there is no substraction depositDetail.depositedAmountUsdValue from vaultValue on liquidation like its done on borrower withdrawal

Root Cause

Whenever borrower deposits there vault value increases:

            // find current vault value by adding current depositing amount
            currentVaultValue = previousData.vaultValue + (amount * currentEthPrice);
            previousData.vaultValue = currentVaultValue;

contracts/lib/BorrowLib.sol#L203

Whenever borrower withdraw there vault value decreases:

            omniChainData.vaultValue -= depositDetail.depositedAmountUsdValue;

Blockchian/contracts/lib/BorrowLib.sol#L922

But when borrowers get liquidated vault value doesn't change. Why is it important? Cds holder's ability to withdraw depends on it, if its not accounting correctly they will not be able to withdraw here:

        if (withdrawResult.omniChainData.totalVolumeOfBorrowersAmountinWei != 0) {
            if (borrowing.calculateRatio(0, ethPrice) < (2 * CDSLib.RATIO_PRECISION)) revert CDS_NotEnoughFundInCDS();
        }

contracts/Core_logic/CDS.sol#L402

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

always happens on liquidations

Impact

CDS holders will not be able to withdraw when they should because the system thinks there are more borrowers than there actually are. Their funds will be stuck. They will be forced to protect borrower collateral that doesn't exist anymore

PoC

No response

Mitigation

update value on liquidation

        omniChainData.totalInterestFromLiquidation += uint256(borrowerDebt - depositDetail.borrowedAmount);
        omniChainData.totalVolumeOfBorrowersAmountinWei -= depositDetail.depositedAmountInETH;
        omniChainData.totalVolumeOfBorrowersAmountinUSD -= depositDetail.depositedAmountUsdValue;
        omniChainData.totalVolumeOfBorrowersAmountLiquidatedInWei += depositDetail.depositedAmountInETH;
+        omniChainData.vaultValue -= depositDetail.depositedAmountUsdValue;