DYAD - AvantGard's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L156-L169 https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205-L228

Vulnerability details

Impact

Impact: high likelihood: mid

Low value accounts will not be liquidated in appropriate time due to gas cost on Ethereum mainnet.

Proof of Concept

Liquidators typically engage in liquidating users for potential profits. However, if there's no profit to be gained, there's no incentive to liquidate undercollateralized accounts.

Lets consider the following 2 scenarios.

Scenario 1:

1. Consider an account with $18 worth of collateral and 10 DYAD tokens minted.

2. The collateral value falls to $14 in a market crash

3. Say, the gas fees for liquidation is $20 due to network demand on ethereum mainnet

(This user is undercollateralized and should ideally be liquidated to maintain protocol integrity)

4. However, given the low value of the account, liquidators may not profit from liquidating this user after factoring in gas costs.

5. Consequently, these low-value accounts may never undergo liquidation, resulting in bad debt accumulation and potentially causing the protocol to become undercollateralized if enough small value accounts are in deficit.

Scenario 2 :

Alice = High net worth attacker

1. Alice shorts DYAD protocol with significant capital and so wants to bring down its value.

2. Alice opens multiple small value accounts when the corresponding collateral price is at an all-time-high. (preferably when network gas cost is relatively lower)

3. The collateral price crashes due to external market conditions, and all their small value accounts become undercollateralized.

4. Liquidators see no value in liquidating these small positions, due to lack of incentives factoring in high gas costs.

5. The DYAD protocol value crashes due to insolvency risks

6. The short will outweigh any losses Alice makes by opening those small value accounts to grief the protocol, making this a profitable attack overall

Tools Used

Manual Analysis

Recommended Mitigation Steps

A potential solution could be to implement a minimum collateral threshold for minting DYAD tokens.

This would ensure that users can only mint DYAD tokens if their collateral value exceeds a certain threshold (say $80), making liquidations economically viable for liquidators.

Assessed type

Other