The CreditDelegationBranch::settleVaultsDebt
function incorrectly deducts the USDC amount obtained from asset swaps from the marketsRealizedDebtUsd
field instead of adding it to the depositedUsdc
field. This issue leads to incorrect accounting of the vault's debt and USDC deposits, potentially causing financial inconsistencies within the protocol.
When a vault is in debt, the protocol swaps the vault's assets to USDC to cover the debt. However, the USDC amount obtained from the swap is incorrectly deducted from the marketsRealizedDebtUsd
field instead of being added to the depositedUsdc
field.
The problematic code is as follows:
https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/market-making/branches/CreditDelegationBranch.sol#L466
Here, ctx.usdcOutX18
represents the amount of USDC obtained from swapping the vault's assets. This amount is subtracted from marketsRealizedDebtUsd
, which is incorrect because:
marketsRealizedDebtUsd
represents the vault's share of the markets' realized debt.
The USDC obtained from the swap should be added to the vault's depositedUsdc
to reflect the additional USDC available to cover the debt.
Incorrect Debt Accounting:
Deducting USDC from marketsRealizedDebtUsd
reduces the vault's share of the markets' realized debt, which is not the intended behavior.
This leads to an understatement of the vault's actual debt, creating inconsistencies in the protocol's accounting system.
Incorrect USDC Balance:
The USDC obtained from the swap is not added to the vault's depositedUsdc
, leading to an understatement of the vault's available USDC balance.
The USDC amount obtained from the swap should be added to the vault's depositedUsdc
instead of being deducted from marketsRealizedDebtUsd
. The corrected code is as follows:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.