Summary

Users who deposit in one vault can lose all deposits and receive nothing

Vulnerability Details

Users who deposit in one vault can lose all deposits and receive nothing when counterparty vault has no deposits

Impact

For a market, if users only deposit in the hedge vault or only deposit in the risk vault but not in both, then these users will lose their deposits and receive nothing when they call the following withdraw function after the depeg event occurs.

Tools Used

VSCode

Recommendations

When users only deposit in one vault, and no one deposits in the counterparty vault, the insurance practice of hedging and risking actually does not exist. In this situation, after the epoch is started, the users, who have deposited, should be allowed to withdraw their full deposit amounts.