Summary

LibVault.updateYield should not accrue rewards to treasury, except yield tithe.

Vulnerability Details

When shorters create new short position, then zethCollateral variable is increased with their collateral + bidder's eth. Shorters that have minted assets are eligible to receive eth rewards that are coming from LST yield. According to the docs, only zeth that is backing asset is eligible for rewards.

LibVault.updateYield function is called to calculate distribution rate.
https://github.com/Cyfrin/2023-09-ditto/blob/main/contracts/libraries/LibVault.sol#L62-L94

As you can see, in case if zethCollateral == 0 everything goes to the treasury as it means that there are no open short positions, so shorters do not receive yields.
Then we can see, that part of yield is going to the treasury.
uint88 zethTreasuryReward = yield.mul(zethTreasury).divU88(zethTotal);

Amount depends on ethEscrowed of treasury. This is violation of the rule. ethEscrowed of treasury is increasing with each withdrawing and unstaking, also when shorter loses yields and this amount doesn't actually participate in asset minting and can be easily withdrawn by dao. Moreover, after that treasury takes one more part of yield as fee(tithe).

As result shorters receive smaller amount of rewards as part of them is distributed to the treasury.

Impact

Shorters receive smaller amount of rewards.

Tools Used

VsCode

Recommendations

In case if zethCollateral != 0 then treasury should receive tithe fee only.