The CreditDelegationBranch::settleVaultsDebt function incorrectly deducts the USDC amount obtained from asset swaps from the marketsRealizedDebtUsd field instead of adding it to the depositedUsdc field. This issue leads to incorrect accounting of the vault's debt and USDC deposits, potentially causing financial inconsistencies within the protocol.
When a vault is in debt, the protocol swaps the vault's assets to USDC to cover the debt. However, the USDC amount obtained from the swap is incorrectly deducted from the marketsRealizedDebtUsd field instead of being added to the depositedUsdc field.
The problematic code is as follows:
https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/market-making/branches/CreditDelegationBranch.sol#L466
Here, ctx.usdcOutX18 represents the amount of USDC obtained from swapping the vault's assets. This amount is subtracted from marketsRealizedDebtUsd, which is incorrect because:
marketsRealizedDebtUsd represents the vault's share of the markets' realized debt.
The USDC obtained from the swap should be added to the vault's depositedUsdc to reflect the additional USDC available to cover the debt.
Incorrect Debt Accounting:
Deducting USDC from marketsRealizedDebtUsd reduces the vault's share of the markets' realized debt, which is not the intended behavior.
This leads to an understatement of the vault's actual debt, creating inconsistencies in the protocol's accounting system.
Incorrect USDC Balance:
The USDC obtained from the swap is not added to the vault's depositedUsdc, leading to an understatement of the vault's available USDC balance.
The USDC amount obtained from the swap should be added to the vault's depositedUsdc instead of being deducted from marketsRealizedDebtUsd. The corrected code is as follows:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.