The Standard

Summary

SmartVaultManagerV5 lacks a process to transfer EURO tokens from fees or liquidations to LiquidationPoolManager for rewards distribution, leaving Liquidity Providers without receiving rewards.

Vulnerability Details

According to the developer, generated rewards are distributed to Liquidity Providers every time there is a liquidation.

When SmartContractManagerV5#Liquidate is called, it triggers vault.liquidate(). This function checks if the vault is undercollateralized. If true, it executes LiquidateNative() and LiquidateERC20(), transferring any tokens held by the vault to ISmartVaultManagerV3(manager).protocol(). If successful, the VaultLiquidated event is emitted.

However, the current implementation of SmartVaultManagerV5 lacks a mechanism to handle the transfer of EURO tokens, generated from fees or liquidations, to the LiquidationPoolManager contract. This transfer is necessary for later distribution among LPs via the distributesFees function.

When LiquidationPoolManager#distributeFees is called, _feesForPool is calculated based on variables such as balanceOf(address(this)), poolFeePercentage, and HUNDRED_PC. If eurosToken.balanceOf(address(this)) equals 0, the condition if(_feesForPool > 0) will not be met. Consequently, leaving Liquidity providers without their due rewards. when increase or decrease their position.

Impact

Liquidity Providers will not receive their due rewards

Tools Used

Manual

Recommendations

Consider implementing a function to handle the transfer of assets collected from liquidations from ISmartVaultManagerV3(manager).protocol() to the LiquidationPoolManager contract.