Skip to content

084.md

Latest commit

 

History

History
119 lines (89 loc) · 4.31 KB

084.md

File metadata and controls

119 lines (89 loc) · 4.31 KB

Low Tangerine Cod

High

omniChainData.downsideProtected and omniChainData.totalCdsDepositedAmount are not in sync

Summary

omniChainData.totalCdsDepositedAmount, omniChainData.downsideProtected should be used together everywhere as their substraction is the actual total cds deposited amount in the protocol at the moment

Root Cause

When borrowers withdraw their position and eth price drops this means that usda amount should decrease thats why there is an increase of downsideProtected

                if (downsideProtected > 0) {
                    omniChainData.downsideProtected += downsideProtected;
                }

contracts/lib/BorrowLib.sol#L874

omniChainData.totalCdsDepositedAmount only being updated with downsideProtected on cds deposits/withdrawals

        if (omniChainData.downsideProtected > 0) {
            omniChainData.totalCdsDepositedAmount -= omniChainData.downsideProtected;
            omniChainData.totalCdsDepositedAmountWithOptionFees -= omniChainData.downsideProtected;
            omniChainData.downsideProtected = 0;
        }

This is why until there are new cds deposits/withdrawal totalCdsDepositedAmount should used together with downsideProtected until then. E.x.

        uint256 liqAmountToGetFromOtherChain = BorrowLib.getLiquidationAmountProportions(
                liquidationAmountNeeded,
                cds.getTotalCdsDepositedAmount(),
-->                omniChainData.totalCdsDepositedAmount - omniChainData.downsideProtected,
                cds.totalAvailableLiquidationAmount(),
                omniChainData.totalAvailableLiquidationAmount
            );

But its not being enforced everywhere which is incorrect. Since total cds deposited amount did updated with downsideProtected on borrowers withdraw. E.x. cumalative value will be incorrect

        CalculateValueResult memory result = _calculateCumulativeValue(
            omniChainData.totalVolumeOfBorrowersAmountinWei,
->            omniChainData.totalCdsDepositedAmount,
            ethPrice
        );

Which means that deposited amount will be tracked incorrect for cds deposited thus they will deposit more or less than they suppose to

        uint256 currentValue = cdsAmountToReturn(
            msg.sender,
            index,
->            omniChainData.cumulativeValue,
            omniChainData.cumulativeValueSign,
            excessProfitCumulativeValue
        ) - 1; //? subtracted extra 1 wei

        cdsDepositDetails.depositedAmount = currentValue;

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Protocol will track user`s deposit incorrectly, which means they will deposit/withdraw more/less than they suppose to. For every borrower after liquidation and for the first cds depositor/withdrawer.

PoC

No response

Mitigation

totalCdsDepositedAmount and downsideProtected should be used together everywhere in project where formula depends on totalCdsDepositedAmount

        if (ethPrice == 0) revert CDS_ETH_PriceFeed_Failed();
        // Get the global omnichain data
        IGlobalVariables.OmniChainData memory omniChainData = globalVariables.getOmniChainData();

        CalculateValueResult memory result = _calculateCumulativeValue(
            omniChainData.totalVolumeOfBorrowersAmountinWei,
-            omniChainData.totalCdsDepositedAmount,
+            omniChainData.totalCdsDepositedAmount- omniChainData.downsideProtected,
            ethPrice
        );

    function updateCumulativeValueInCDS(
        IGlobalVariables globalVariables,
        CDSInterface cds,
        uint64 ethPrice
    ) public returns (uint128, bool) {
        IGlobalVariables.OmniChainData memory omniChainData = globalVariables.getOmniChainData();
        // Calculate the cumulatice value
        CDSInterface.CalculateValueResult memory result = cds.calculateCumulativeValue(
                omniChainData.totalVolumeOfBorrowersAmountinWei,
-                omniChainData.totalCdsDepositedAmount,
+                omniChainData.totalCdsDepositedAmount- omniChainData.downsideProtected,
                ethPrice
            );