The Standard

Description:
When users burn EUROs, a small portion is intended to be sent to the Liquidator address (i.e., LiquidatorPoolManager) to distribute to stakers. However, the vault erroneously sends these fees to the protocol address, which is the treasury. Instances of fees being directed to the protocol instead of the liquidator are evident in the following code segments:

• Burn Fees sent to protocol - Line 173

To clarify any doubts or confusion about the difference between the protocol and liquidator addresses, consider the following points:

• The known issues section of the contest document describes the protocol address as the treasury address.
  "protocol address must be payable and able to handle ERC20s transferred. This address will be set to our Protocol's treasury wallet."

• This code line clearly states which address is the liquidator. This point is further reinforced by the onlyLiquidator modifier.

Impact:

When fees are sent to the protocol instead of the liquidator, the stakers receive no rewards, which disincentives them from staking. Although the funds aren't permanently lost, as they can always be sent back to the liquidator, the advantage gained from staking early is lost for early stakers.

Proof of Concept:

For a visual representation of the value flow in the network, see here.

Tools Used:

• Manual review

Recommended Mitigation Steps:

Transfer fees to liquidator instead of protocol.