Part 2

Summary

When a new vault is added for a market, a CreditDelegation struct is created for each tuple of Market and Vault. Initially, all values in the CreditDelegation struct are set to 0. This leads to a significant issue because, currently, when the values of CreditDelegation are 0, they can only be updated if there is some WETH available for distribution. If no WETH is available, the debt for the vault will not be distributed until any WETH becomes available. On the other hand if there is a WETH available at the beginning, the protocol will try to distrbute share of it to the vault, even if it joins now. This happens because the calculation involves subtracting wethRewardPerVaultShare - lastVaultDistributedWethRewardPerShareX18, and lastVaultDistributedWethRewardPerShareX18 is initially 0.

Vulnerability Details

The issue arises in the debt distribution mechanism for new vaults. When a new vault is added, the CreditDelegation struct is initialized with default values of 0. The debt distribution logic relies on the difference between wethRewardPerVaultShare and lastVaultDistributedWethRewardPerShareX18. Since lastVaultDistributedWethRewardPerShareX18 is 0 initially, the system will attempt to distribute all WETH accumulated since the market's inception. This can lead to incorrect debt calculations and unfair distribution of rewards.

Key Points:

1. Initialization Issue: New vaults start with lastVaultDistributedWethRewardPerShareX18 = 0.

2. Debt Distribution: Debt is only distributed when WETH is available, and the calculation uses wethRewardPerVaultShare - lastVaultDistributedWethRewardPerShareX18.

3. Accumulated Debt: If WETH is not available initially, debt will not be distributed until WETH becomes available. When it does, the system will attempt to distribute all debt from the begging, leading to incorrect calculations.

Impact

1. Incorrect Debt Accumulation: Debt for new vaults will not be accumulated until WETH is available for distribution.

2. Wrong totalCreditCapacity: The totalCreditCapacity of vaults will be computed incorrectly, leading to inaccurate debt calculations.

3. Unfair Distribution: Vaults added later may receive an unfair share of rewards due to the accumulation of WETH from the beginning of the market.

Tools Used

Manual review

Recommendations

To fix this issue, ensure that the CreditDelegation struct is correctly initialized when a new vault is added. Specifically, set lastVaultDistributedWethRewardPerShareX18 to the current wethRewardPerVaultShare at the time of vault creation. This will prevent the system from attempting to distribute all accumulated WETH from the beginning of the market.