Sleepy Sepia Zebra - The CDS.withdraw will be DOS when current exchangeRate is fewer than liquidation exchangeRate

[sherlock-admin3]

Sleepy Sepia Zebra

Medium

The CDS.withdraw will be DOS when current exchangeRate is fewer than liquidation exchangeRate

Summary

There is calculation for the weeth and rseth amount without yields. But this calculation could revert in some case.

Root Cause

In the CDSLib.sol:672 withdrawUser() calculates the weeth and rseth amount without yields.

The weETHAmountInETHValue is the eth amount for weETH based on liquidation exchangeRate. The exchangeRate varies and when current exchangeRate is fewer than liquidation exchangeRate, (weETHAmountInETHValue * 1 ether) / params.weETH_ExchangeRate) will be greater than weETHAmount.

As result, CDSLib.withdrawUswer() will revert and this breaks the invariants of protocol - "New Borrows cannot mint new stablecoin if cds/borrow ratio is below 0.2 and cds users cannot withdraw."

    function withdrawUser(
        CDSInterface.WithdrawUserParams memory params,
        CDSInterface.Interfaces memory interfaces,
        uint256 totalCdsDepositedAmount,
        uint256 totalCdsDepositedAmountWithOptionFees,
        mapping(uint128 liquidationIndex => CDSInterface.LiquidationInfo)
            storage omniChainCDSLiqIndexToInfo
    ) public returns (CDSInterface.WithdrawResult memory) {

        ...

        // Calculate the weeth and rseth amount without yields
        weETHAmount = weETHAmount - (weETHAmount - ((weETHAmountInETHValue * 1 ether) / params.weETH_ExchangeRate));
        rsETHAmount = rsETHAmount - (rsETHAmount - ((rsETHAmountInETHValue * 1 ether) / params.rsETH_ExchangeRate));

        ...
    }

Internal pre-conditions

External pre-conditions

Attack Path

Impact

CDS users can't withdraw and this could break the invariants of the protocol

Mitigation

Implement correct handling for cases where current exchangeRate is fewer than liquidation exchangeRate.