The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Absence of Stored Accepted Token in `SmartVaultV3` May Lead to Loss of Funds and Inflation of the Used Stablecoin

n0kto

Description

Accepted tokens are queried from the TokenManager each time instead of being stored in the vault at its creation. While adding a new token might be straightforward for vaults, removing one can have catastrophic consequences.

A simple example involves a user with only WBTC, minting 99% of what they can borrow. If WBTC is removed, maxMintable will return 0, and undercollateralized will return true. The vault will be liquidated, but no Asset will be distributed, resulting in a complete loss for the protocol and inflating the EUROs stablecoin.

Impact

  • Loss of funds for the protocol if the token represents a significant portion of collateral in user vaults.

  • Unexpected liquidation for users, resulting in a potential loss of all other tokens in the vault.

  • Inflation of the borrowed stablecoin.

If removing tokens becomes a common feature, this is a HIGH finding. However, assuming the likelihood is low (only in the case of a bug with a token), the severity is considered MEDIUM.

Proof of Concept

Foundry PoC
function testManagerRemoveToken() public {
uint EUROs_TotalSupply_mintedInSetUp = 10000e18;
// Normal usage of the vault: borrow 90 EUROs with 100 USDs in collateral
vm.startPrank(vaultUser);
USDs.transfer(address(vault), 100e18);
uint fees = (10e18 * 500) / 1e5;
vault.mint(vaultUser, 90e18);
vm.stopPrank();
​
// Token removal
vm.prank(protocol);
tokenManager.removeAcceptedToken("USDs");
​
// Catastrophe happens
assertTrue(vault.undercollateralised());
vm.prank(protocol);
liquidationPoolManager.runLiquidation(vaultID);
​
// Vault was liquidated without restituting euros or tokens
assertEq(USDs.balanceOf(protocol), 0);
assertTrue(EUROs.balanceOf(protocol) < 100e18);
​
// EUROs total supply has inflated!
assertTrue(EUROs.totalSupply() > EUROs_TotalSupply_mintedInSetUp);
}

Recommended Mitigation

  • Store accepted tokens in the vault. Moreover, it would consume less gas.

  • If a token needs to be removed, warn users in advance and encourage them to open a new vault.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

remove-token

hrishibhat Lead Judge
over 1 year ago
hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

removetoken-low

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.