The Standard

Description:

When vaults are liquidated, their collateral is sent to the LiquidationPool to be sold for EUROs. If there aren't enough EUROs in the pool to buy these liquidated assets, they are returned to the LiquidationPoolManager, which then forwards them to the protocol's address (i.e., treasury). This implies a delay between the vault liquidation and collateral sell-off to balance the supply of EUROs. If the price of these collateral assets falls dramatically during this period, the protocol will have to incur a loss to balance the supply of EUROs.

Impact:

Potential loss for the protocol due to a delay in the liquidation process.

Proof of Concept:
Consider the following sequence of actions:

• Vault_1 is minted and supplied 1,000 ETH @ $3,000, i.e., $3,000,000 collateral.

• Owners mint $2,500,000 worth of EUROs.

• Vault is above the liquidation threshold.

• ETH prices drop to $2,600.

• Vault enters the liquidation threshold.

• Vault is liquidated and sent to LiquidationPool to be sold.

• The LiquidationPool only has $1,000,000 worth of EUROs to buy collateral assets.

• $1,600,000 is sent to the protocol's address (treasury) after selling to the LiquidationPool.

• There is a delay between the treasury receiving these assets and selling them to buyback and burn EUROs.

• If the price of ETH drops further, the funds recuperated may not be enough to buy back the necessary amount of EUROs to balance its supply.

• Also, the further the ETH price drops, the higher the debt gets for the protocol.

Tools Used:

• Manual review

Recommended Mitigation Steps:

• Constantly monitor the protocol to ensure the LiquidationPool can support any liquidated amount.

• Further democratize the liquidation process by allowing other network actors, other than the LiquidationPoolManager and LiquidationPool, to be able to liquidate vaults and buy the asset.

• Only send the amount of liquidated asset that the LiquidationPool can purchase, and send the rest to alternative buyers like the open market or OTC. Just ensure the alternative is a safe option.