Skip to content

Instantly share code, notes, and snippets.

@anontheauditor
Created June 1, 2024 10:21
Show Gist options
  • Select an option

  • Save anontheauditor/8ee9d6b5ebc86b08e278ef876c63d19a to your computer and use it in GitHub Desktop.

Select an option

Save anontheauditor/8ee9d6b5ebc86b08e278ef876c63d19a to your computer and use it in GitHub Desktop.

[H-02] code4rena issue #338 not fixed properly

Severity

Impact: High

Likelihood: Medium

Description

Code4rena issue #338 linked here: code-423n4/2024-04-dyad-findings#338.

The issue shows that liquidations do not go through if the exogenous collateral don't sufficiently back the DYAD minted.

The protocol lays down 2 ground rules:

  1. Exo collateral backs DYAD at least 1:1 (100%)
  2. Kerosene can be used to keep the minimum backing to 150%.

So for this to function properly, a user must have exo-backing of 100% and exo+kerosene backing of 150%.

But if a user's exo-backing falls below 100% but their exo+kerosene backing is still above 150%, they wont get liquidated.

if (collatRatio(id) >= MIN_COLLAT_RATIO) revert CrTooHigh();

This can lead to systematic problems with collateral backing.

Say there is 1 million USD worth of exo collateral, and 1 million DYAD minted. Say 600 k USD worth of kerosene is also in the vaults.

Now, Exo collateral backing = 1 million / 1 million = 100% Total backing = 1.6 / 1 = 160%.

Now say the price of the exo collateral drops so there is only 950k USD worth of exo collateral left.

Now, exo collateral backing = 950k / 1 million = 95% Total backing = 1.55 / 1 = 155 %

If this was a single vault, this wouldn't be liquidatable since the CR is still above 150%.

The overall backing of the system is not 100% with exo collateral anymore. This can lead to people closing and withdrawing funds from their vaults, which further reduces the TVL of the system.

The main idea is that the system and individual vaults can reach a state where some of the dyad is backed by kerosene, and not by other exo collateral. This would make it a fractionally collateralized stablecoin, like FRAX or DEI, both of which had stability issues and FRAX later voted to fully collateralized itself.

Mitigation recommendation

Consider allowing liquidations when exo collateral backing goes below 100% as well. This will prevent the total exo collateral backing to go below 100% unless its a large bad debt event.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment