Part 2

Summary

totalDebtUsdX18 can be negative, causing a reversion in intoUD60x18() operation. If a market has negative debt (net credit), calling getAutoDeleverageFactor() will always revert. Solidity’s UD60x18 type will revert when trying to convert a negative SD59x18 number to positive number. totalDebtUsdX18.div(sdDelegatedCreditUsdX18).intoUD60x18() will revert if totalDebtUsdX18 < 0.

Vulnerability Details

The key issue is in this line:

totalDebtUsdX18 is of type SD59x18, meaning it will be negative when debt is negative. Conversion from negative SD59x18 to UD60x18 will always fail and revert. So when market is in negative debt, calls to CreditDelegationBranch::withdrawUsdTokenFromMarket will always revert

Impact

• Engines will fail to mint new USD token as it will always revert when withdrawUsdTokenFromMarket will be called

Recommendation

Add a Check for Negative totalDebtUsdX18, if it is negative, multiply it with -1 before division and conversion to UD60x18 type