Root + Impact

Description

• Normal behavior: redeem_collateral should reject zero-amount redemptions and liquidation paths should never process dust amounts, so that no zero-value transfers or empty events pollute the protocol accounting and event logs.

• The issue: _redeem_collateral in dsc_engine.vy has no zero-amount guard. Calling redeem_collateral(token, 0) executes the full redemption flow — events and zero-value ERC20 transfers — for nothing. Dust liquidation paths where token_amount_from_debt_covered rounds down to 0 for tiny debts behave the same way.

Risk

• Reason 1 // There is no validation that the redeemed token amount is greater than zero anywhere in the redemption flow.

• Reason 2 // Tiny-debt liquidations can compute a zero token amount from rounding, reaching the same path.

• Impact 1 // Zero-value transfers and empty events add noise to on-chain accounting and event history; harmless economically.

• Impact 2 // Minor grief vector: cheap transactions can spam zero-amount redeem events.

Proof of Concept

Call redeem_collateral(WETH, 0) as a user with no debt: the call succeeds, emits a redeem event, and performs zero-value transfers instead of reverting.

Recommended Mitigation

Add a zero-amount guard at the top of the redemption flow: