DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Collateral cannot be decreased without debt

caventa

Summary

Collateral cannot be decreased without debt

Vulnerability Details

The function ShortRecordFacet#increaseCollateral permits users to augment their collateral. However, if the same individual attempts to reduce this collateral without having any associated debt, the operation fails. The issue originates from the line:

uint256 cRatio = short.getCollateralRatio(asset);

found in ShortRecordFacet#decreaseCollateral. This is due to the calculation in LibShortRecord#getCollateralRatio:

return short.collateral.div(short.ercDebt.mul(LibOracle.getPrice(asset)));

in LibShortRecord#getCollateralRatio

When short.ercDebt is zero, it results in a division by zero error.

Impact

Users are restricted from decreasing their collateral unless they have an associated debt.

Tools Used

Manual

Recommendations

To rectify this, modifications should be made to the ShortRecordFacet#decreaseCollateral function as follows:

function decreaseCollateral(address asset, uint8 id, uint88 amount)
external
isNotFrozen(asset)
nonReentrant
onlyValidShortRecord(asset, msg.sender, id)
{
STypes.ShortRecord storage short = s.shortRecords[asset][msg.sender][id];
short.updateErcDebt(asset);
if (amount > short.collateral) revert Errors.InsufficientCollateral();
​
short.collateral -= amount;
​
- uint256 cRatio = short.getCollateralRatio(asset);
- if (cRatio < LibAsset.initialMargin(asset)) {
+ uint256 cRatio = 0;
+ // Try to get the collateral ratio
+ try short.getCollateralRatio(asset) returns (uint256 result) {
+ cRatio = result;
+ } catch {
+ // If there's an exception (like division by zero), set cRatio to 0
+ cRatio = 0;
+ }
​
+ // Only check against initial margin if cRatio is not 0
+ if (cRatio != 0 && cRatio < LibAsset.initialMargin(asset)) {
revert Errors.CollateralLowerThanMin();
}
​
uint256 vault = s.asset[asset].vault;
s.vaultUser[vault][msg.sender].ethEscrowed += amount;
​
LibShortRecord.disburseCollateral(
asset, msg.sender, amount, short.zethYieldRate, short.updatedAt
);
emit Events.DecreaseCollateral(asset, msg.sender, id, amount);
}
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.