The Standard

Description:
When users swap EUROs, a small fee is intended to be sent to the SmartVaultManagerV5::liquidator address (i.e., LiquidatorPoolManager) to distribute to stakers. However, the vault erroneously sends these fees to the SmartVaultManagerV5::protocol address, which is the treasury. Instances of fees being directed to the SmartVaultManagerV5::protocol instead of the SmartVaultManagerV5::liquidator are evident in the following code segments:

• Swap Fees sent to protocol- Line 165

• Swap Fees sent to protocol- Line 165

To clarify any doubts or confusion about the difference between the protocol and liquidator addresses, consider the following points:

• The known issues section of the contest document describes the protocol address as the treasury address.
  "protocol address must be payable and able to handle ERC20s transferred. This address will be set to our Protocol's treasury wallet."

• This code line clearly states which address is the liquidator. This point is further reinforced by the onlyLiquidator modifier.

Impact:

When fees are sent to the protocol instead of the liquidator, the stakers receive no rewards, which disincentives them from staking. Although the funds aren't permanently lost, as they can always be sent back to the liquidator, the advantage gained from staking early is lost for early stakers.

Proof of Concept:

For a visual representation of the value flow in the network, see here.

Tools Used:

• Manual review

• Foundry

Recommended Mitigation Steps:

Transfer fees to liquidator instead of protocol.