DYAD - atoko's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205

Vulnerability details

Impact

The current implementation of a fixed liquidation bonus in the protocol's liquidate function poses a risk of preventing liquidation when a user's collateral is close to their debt amount. Due to the fixed bonus, users may not be liquidated even when their health factor falls below the critical threshold. This issue can lead to instability in the protocol, as it undermines the mechanism to maintain collateralization ratios, potentially exposing the protocol to insolvency risks.

uint public constant LIQUIDATION_REWARD        = 0.2e18; //  20%

 function liquidate(
    uint id,
    uint to
  ) 
    external 
      isValidDNft(id)
      isValidDNft(to)
    {
      uint cr = collatRatio(id);
      if (cr >= MIN_COLLATERIZATION_RATIO) revert CrTooHigh();
      dyad.burn(id, msg.sender, dyad.mintedDyad(address(this), id));

      uint cappedCr               = cr < 1e18 ? 1e18 : cr;
      uint liquidationEquityShare = (cappedCr - 1e18).mulWadDown(LIQUIDATION_REWARD);
      uint liquidationAssetShare  = (liquidationEquityShare + 1e18).divWadDown(cappedCr);

      uint numberOfVaults = vaults[id].length();
      for (uint i = 0; i < numberOfVaults; i++) {
          Vault vault      = Vault(vaults[id].at(i));
          uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);
          vault.move(id, to, collateral);
      }
      emit Liquidate(id, msg.sender, to);
  }

Proof of Concept

Consider a scenario where a user's collateral is very low, and the fixed liquidation bonus is significant. When a liquidator attempts to liquidate the user, they cannot cover the full deficit plus the bonus, leading to the transaction being reverted. This scenario can occur especially when multiple types of collateral are involved, and one type's value decreases significantly.

The reason is that when a user gets liquidated, 20% of the amount of liquidation will be sent to the liquidator as the liquidation bonus; however, if the user is not able to provide the liquidation bonus completely in their account, the liquidation will be reverted, because the user does not have sufficient funds.

Tools Used

Manual Review

Recommended Mitigation Steps

implement a dynamic calculation for the liquidation bonus based on the user's health factor or the amount of available collateral. By adjusting the bonus dynamically, the protocol ensures that liquidation is always possible, even when users are close to the threshold.

Assessed type

Context

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205

Vulnerability details

Impact

The absence of incentive to liquidate small positions, such as those with low corresponding usd values, can lead to accumulation of unliquidated accounts in the protocol making the protocol unhealthy considering there are a lot of such users in the protocol. This not only leaves these accounts vulnerable to potential insolvency but also hinders the efficient utilization of resources due to gas costs.

at the moment users are able to mind DYAD tokens regardless of their collateral amount

    function mintDyad(
        uint id,
        uint amount,
        address to
    ) external isDNftOwner(id) {
        uint newDyadMinted = dyad.mintedDyad(address(this), id) + amount;
        if (getNonKeroseneValue(id) < newDyadMinted)
            revert NotEnoughExoCollat();
        dyad.mint(id, to, amount);
        if (collatRatio(id) < MIN_COLLATERIZATION_RATIO) revert CrTooLow();
        emit MintDyad(id, amount, to);
    }

Proof of Concept

Consider a scenario where a user's account holds a small amount of collateral, for example, $5 USD of value. Due to the gas costs involved in executing the liquidation process, liquidators may find it uneconomical to liquidate such low-value accounts. As a result, these accounts remain unliquidated, potentially accumulating over time.

Tools Used

manual review

Recommended Mitigation Steps

A potential fix could be to only allow users to mint DYAD if their collateral value is past a certain threshold.

Assessed type

Context