The Standard

Description:

When vaults are liquidated, they are intended to be sent to the Liquidator address (i.e., LiquidatorPoolManager) to manage the liquidated assets. However, the vault erroneously sends these assets to the protocol address, which is the treasury. Instances of liquidated assets being directed to the protocol instead of the liquidator are evident in the following code segments:

• Liquidated Assets - Lines 105C115 to 105C115

• Liquidated Assets - Line 111

To clarify any doubts or confusion about the difference between the protocol and liquidator addresses, consider the following points:

• The known issues section of the contest document describes the protocol address as the treasury address.
  "protocol address must be payable and able to handle ERC20s transferred. This address will be set to our Protocol's treasury wallet."

• This code line clearly states which address is the liquidator. This point is further reinforced by the onlyLiquidator modifier.

Misdirection of liquidated assets leads to undercollateralization of EUROs, as assets are not immediately sold to balance the supply of EUROs. When a vault is liquidated, the collateral is sent to the protocol (treasury), instead of the liquidator (LiquidityPoolManager). As a result, these liquidated collateral are not sold immediately to buy back EUROs and burn, leading to undercollateralization of EUROs supply.

Impact:

Sending the Liquidated assets to the wrong address implies a delay between when vaults are liquidated and when they are actually sold to buy back and burn EUROs to balance the supply. If the price drops dramatically during this period, it could incur losses for the protocol.

Proof of Concept:

For a visual representation of the value flow in the network, see here.

Tools Used:

• Manual review

Recommended Mitigation Steps:

Transfer assets to liquidator instead of protocol.