The Standard

Description

One aspect of the current protocol design that is unclear relates to the use of TST as a staking token. The implementation of LiquidationPool::distributeFees suggests that it is used as an incentive token to earn a proportional share of the EURO fees; however, LiquidationPool::stake returns the minimum of the staked EURO and TST values, as shown below.

It is possible to stake only a single token in calls to LiquidationPool::increasePosition which has the implication that LiquidationPool::stake will return zero whenever this is the case. For zero EURO collateral, this makes sense since TST alone cannot be used to liquidate undercollateralized vaults; however, if the TST balance is zero, then the non-zero EURO stake will not be considered in the stake total sum in LiquidationPool::getStakeTotal.

Here, it is not clear why TST and EURO balances are mixed between holders since it is likely that some will deposit more TST while others deposit more EURO, and LiquidationPool::stake returns the smaller of the two virtual balances. This has the implication that the liquidation portion calculations in LiquidationPool::distributeAssets are very likely incorrect and could lead to bad debt accruing in the protocol due to unhandled partial liquidations.

Impact

The impact of this finding is low due to an insufficient understanding of the protocol intentions.

Recommended Mitigation

Since only EURO can be used in the liquidation of undercollateralized vaults, it is recommended to only consider EURO balances when calculating the stake total.