DittoETH

Summary

According to documentation

When CR >= minimumCR, the shorter will get back some of their collateral, with 1 CR worth of collateral being burned to cover the position's debt. When CR < minimumCR, the shorter doesn't get anything back, and the remaining collateral goes to the TAPP. If the CR < 1, then the TAPP is getting less collateral back in paying off the under-collateralized debt.

However code is different, it will not repay collateral back if CR == minimumCR.

Vulnerability Details

m.loseCollateral should be true when CR is strictly lower than minimumCR:

https://github.com/Cyfrin/2023-09-ditto/blob/a93b4276420a092913f43169a353a6198d3c21b9/contracts/facets/MarginCallPrimaryFacet.sol#L213

This variable then used to determine whether to repay collateral to user:

https://github.com/Cyfrin/2023-09-ditto/blob/a93b4276420a092913f43169a353a6198d3c21b9/contracts/facets/MarginCallPrimaryFacet.sol#L306-L310

https://github.com/Cyfrin/2023-09-ditto/blob/a93b4276420a092913f43169a353a6198d3c21b9/contracts/facets/MarginCallPrimaryFacet.sol#L323-L336

Impact

User will lose collateral payout in case CR == minimumCR

Tools Used

Manual Review

Recommendations