The Standard

Summary

Swap fees are not distributed to TST stakers, but are sent to the pool along with liquidation.

Vulnerability Details

When SmartVaultV3 owner mints and burns EURO tokens, then he sends part of them as fees to the LiquidationPoolManager.

Same thing is done, when user swap his collateral tokens. In this case the fee is paid in form of collateral token.

These fees that user pays should be distributed to the TST stakers. This is done, when LiquidationPoolManager.distributeFees is called.

The problem is that LiquidationPoolManager.distributeFees function handles only EURO token fees and does not distribute native token and collateral tokens fees. Those tokens are sent together with liquidation which is not correct as liquidation can even not happen. And also there is another problem with that. As bigger amount of tokens is sent during the liquidation(because fees are also sent together with collateral of the vault), then it's possible that burnEuros that will be burnt will be even biggern than vault's minted amount, which should not happen.

Impact

Loss of rewards for TST stakers.

Tools Used

VsCode

Recommendations

Distribute all fees to the TST stakers.