The Standard

Description:

According to the whitepaper (pg 15 - CH 2.8.2), the distribution formula "ensures a fair distribution of assets based on each participant's contribution to the liquidation pool in terms of sEURO and TST tokens." However, the actual code falls short of this objective. The rewards in terms of liquidated assets and fees are disproportionate to the value stakers add to the pool. Stakers without TST positions receive no fees and rewards, despite contributing the resources necessary to achieve the pool's objective function.

Impact:

This discrepancy disincentivizes staking activities in the network, potentially leading to a decline in TVL and a shortage of liquidity necessary for facilitating liquidation.

Proof of Concept:

Given the following scenario:

Liquidated Asset: wBTC = 1e8 (limiting to one token for simplicity)
BTC/USD price = 40000e8
wBTC decimals = 8
EUR/USD price = 1.12e8
_hundredPC = 1e5
_collateralRate = 110000

Position0.TST value = 1000 * 1e0 * 1e8 = 1000e8
Position0.EUROs value = 100 * 1e0 * 1.12e8 = 112e8
Total Staked value = 1112e8

[... Other positions described similarly ...]

Total Value Locked (TVL) = 2441.6e8

distributeAssets() Logic Breakdown:

stakeTotal = getStakeTotal() == 115
|- getStakeTotal() = 115
|- stake() = For Loop:
// Sum the smaller amount of the staked tokens
// This is a technique to incentivize a balanced stake of both tokens

• position0 returns 100

• position1 returns 0

• position2 returns 0

• position3 returns 5

• position4 returns 10

Note:

• The stake() function compares the amounts of _position.TST and _position.EUROs, not their values. This approach is not recommended for comparing different tokens.

• The return value of Position3 is greater than that of Position1 and Position2, despite contributing the least value to the protocol.

• Despite adding value to the pool, Position1 and Position2 will not participate in the reward distribution.

Tools Used:

• Manual review

Recommended Mitigation Steps:

Reward stakers according to the effective value added to the pool. Effective value is the value that takes the pool closer to achieving its objective function, which is processing liquidation.