DYAD - Myrault's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L230-L239

Vulnerability details

Impact

Kerosene will not be moved during the liquidation. When kerosene accounts for a high proportion of mortgage assets, for example, when the mortgage ratio reaches 145%, of which kerosene accounts for 100%, and the remaining 45% is non-kerosene collateral, the funds obtained by the liquidation will be less than the payment. The liquidator will abandon the liquidation, resulting in the creation of bad debts.

Proof of Concept

function collatRatio(
    uint id
  )
    public 
    view
    returns (uint) {
      uint _dyad = dyad.mintedDyad(address(this), id);
      if (_dyad == 0) return type(uint).max;
      return getTotalUsdValue(id).divWadDown(_dyad);
  }

function liquidate(
...
uint numberOfVaults = vaults[id].length();
      for (uint i = 0; i < numberOfVaults; i++) {
          Vault vault      = Vault(vaults[id].at(i));
          uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);
          vault.move(id, to, collateral);
      }
      emit Liquidate(id, msg.sender, to);
...

Tools Used

Manual review

Recommended Mitigation Steps

Liquidators are allowed to move kerosene in liquidation

Assessed type

Other

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205-L228

Vulnerability details

Impact

When collatRatio is less than or equal to 100%, liquidation reward is 0，the liquidator will not liquidate the non-performing asset.

Proof of Concept

...
      uint cappedCr               = cr < 1e18 ? 1e18 : cr;
      uint liquidationEquityShare = (cappedCr - 1e18).mulWadDown(LIQUIDATION_REWARD); 
      uint liquidationAssetShare  = (liquidationEquityShare + 1e18).divWadDown(cappedCr);

      uint numberOfVaults = vaults[id].length();
      for (uint i = 0; i < numberOfVaults; i++) {
          Vault vault      = Vault(vaults[id].at(i));
          uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);
          vault.move(id, to, collateral);
      }
      emit Liquidate(id, msg.sender, to);
  }

Tools Used

Mannual review

Recommended Mitigation Steps

Add the function of automatic liquidation when collatRatio is less than or equal to 100%

Assessed type

Other