DYAD - vahdrak1's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L230

Vulnerability details

Impact

collatRatio = (NonKerosene+Kerosene)/DYAD. Since during the liquidation process, only non-kerosene will be moved. When kerosene accounts for a very high proportion of mortgage assets, for example, when the mortgage ratio reaches 120%, of which kerosene accounts for 50%, and the remaining 70% is non-kerosene collateral, the funds obtained by the liquidation will be less than the payment required for liquidation funds. Therefore, liquidation will not be initiated, resulting in the creation of bad debts.

Proof of Concept

function collatRatio(
    uint id
  )
    public 
    view
    returns (uint) {
      uint _dyad = dyad.mintedDyad(address(this), id);
      if (_dyad == 0) return type(uint).max;
      return getTotalUsdValue(id).divWadDown(_dyad);
  }

function liquidate(
...
uint numberOfVaults = vaults[id].length();
      for (uint i = 0; i < numberOfVaults; i++) {
          Vault vault      = Vault(vaults[id].at(i));
          uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);
          vault.move(id, to, collateral);
      }
      emit Liquidate(id, msg.sender, to);
...

Tools Used

Manual review

Recommended Mitigation Steps

Liquidators are allowed to move kerosene in liquidation

Assessed type

Other

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205

Vulnerability details

Impact

When collatRatio is less than or equal to 100%, according to the calculation formula liquidationEquityShare = (cappedCr - 1e18).mulWadDown(LIQUIDATION_REWARD), the liquidation reward is 0, and no liquidator will liquidate this non-performing asset.

Proof of Concept

function liquidate(
    uint id,
    uint to
  ) 
    external 
      isValidDNft(id)
      isValidDNft(to)
    {
      uint cr = collatRatio(id);
      if (cr >= MIN_COLLATERIZATION_RATIO) revert CrTooHigh();
      dyad.burn(id, msg.sender, dyad.mintedDyad(address(this), id));

      uint cappedCr               = cr < 1e18 ? 1e18 : cr;
      uint liquidationEquityShare = (cappedCr - 1e18).mulWadDown(LIQUIDATION_REWARD); 
      uint liquidationAssetShare  = (liquidationEquityShare + 1e18).divWadDown(cappedCr);

      uint numberOfVaults = vaults[id].length();
      for (uint i = 0; i < numberOfVaults; i++) {
          Vault vault      = Vault(vaults[id].at(i));
          uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);
          vault.move(id, to, collateral);
      }
      emit Liquidate(id, msg.sender, to);
  }

Tools Used

Mannual review

Recommended Mitigation Steps

Add the function of automatic liquidation when collatRatio is less than or equal to 100%

Assessed type

Other