DYAD - miaowu's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205-L228

Vulnerability details

Impact

1. Use (NonKerosene+Kerosene)/DYAD when calculating the collatRatio, but liquidation only moves the non-kerosene part
2. When kerosene tokens account for a very high proportion of mortgage assets, such as: the collatRatio is 140%, kerosene tokens account for 100%, and the remaining 40% is non-kerosene collateral, the money obtained from liquidation will be far less than money to be paid for liquidation
3. Therefore liquidation will not be initiated, resulting in bad debts

Proof of Concept

function collatRatio(
    uint id
  )
    public 
    view
    returns (uint) {
      uint _dyad = dyad.mintedDyad(address(this), id);
      if (_dyad == 0) return type(uint).max;
      return getTotalUsdValue(id).divWadDown(_dyad); //TotalUsdValue！
  }

function liquidate(
...
uint numberOfVaults = vaults[id].length();
      for (uint i = 0; i < numberOfVaults; i++) {
          Vault vault      = Vault(vaults[id].at(i));
          uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);
          vault.move(id, to, collateral);
      }
      emit Liquidate(id, msg.sender, to);
...

Tools Used

Manual review

Recommended Mitigation Steps

Limit the proportion of kerosene, or allow move kerosene during liquidation

Assessed type

Other

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205-L228

Vulnerability details

Impact

When the collatRatio is less than or equal to 100%, the value of cappedCr - 1e18 is 0, the liquidation reward is 0. At this time, no user will initiate liquidation, resulting in bad debts

Proof of Concept

function liquidate(
    uint id,
    uint to
  ) 
    external 
      isValidDNft(id)
      isValidDNft(to)
    {
      uint cr = collatRatio(id);
      if (cr >= MIN_COLLATERIZATION_RATIO) revert CrTooHigh();
      dyad.burn(id, msg.sender, dyad.mintedDyad(address(this), id));

      uint cappedCr               = cr < 1e18 ? 1e18 : cr;
      uint liquidationEquityShare = (cappedCr - 1e18).mulWadDown(LIQUIDATION_REWARD); //here！
      uint liquidationAssetShare  = (liquidationEquityShare + 1e18).divWadDown(cappedCr);

      uint numberOfVaults = vaults[id].length();
      for (uint i = 0; i < numberOfVaults; i++) {
          Vault vault      = Vault(vaults[id].at(i));
          uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);
          vault.move(id, to, collateral);
      }
      emit Liquidate(id, msg.sender, to);
  }

Tools Used

Mannual review

Recommended Mitigation Steps

Added forced liquidation function, forced liquidation when the collatRatio is less than or equal to 100%

Assessed type

Other