The Standard

The Standard
DeFiHardhat
20,000 USDC
View results
Submission Details
Severity: low
Invalid

Price Comparison Issue in `LiquidationPool::stake` Poses Protocol Risk

Description

The LiquidationPool::stake function determines the maximum balance between EUROs and TST, potentially leading to issues when comparing the two without considering their respective prices. This becomes problematic, especially when TST is volatile, while EUROs remain stable. The absence of an Oracle to fetch the TST price in EUROs creates scenarios where the protocol's integrity can be compromised.

Concrete cases illustrating the problem include:

  • TST being at a very low price: A user can acquire a substantial amount of TST for a minimal EUROs investment, resulting in an imbalanced stake.

  • TST being at a very high price: Similar to the low price scenario, this creates an imbalance in the staking process.

  • Time-related problem: If a user acquires TST at an exceptionally low price, stakes it, and the TST price surges, subsequent users may struggle to add enough TST against EUROs, favoring only the early stakers for rewards.

function stake(Position memory _position) private pure returns (uint256) {
return
@> _position.TST > _position.EUROs ? _position.EUROs : _position.TST;
}

Impact

In the event of a significant TST price increase, the pool may become unusable for new stakers, leading to rewards predominantly benefiting early stakers.

Recommended Mitigation

Consider the following solutions:

  • Introduce an Oracle to facilitate a fair comparison between TST and EUROs.

  • Remove EUROs from the LiquidationPool::stake logic and use TST exclusively for staking, utilizing EUROs solely for "buying" assets in LiquidationPool::distributeAssets.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.