GalloDaSballo / Apollon-Review

Notes for the Apollon Solo Security Review
0 stars 0 forks source link

Redemptions allow to have Troves that have collaterals mostly in debtTokens #67

Closed GalloDaSballo closed 2 months ago

GalloDaSballo commented 3 months ago

Can influence ratio of Debts used as Coll by redeeming due to the logic not allowing redemption on debt tokens

BO has the following check: https://github.com/blkswnStudio/ap/blob/8fab2b32b4f55efd92819bd1d0da9bed4b339e87/packages/contracts/contracts/BorrowerOperations.sol#L398-L399

    if (_debtTokenUsedAsCollRatio(contractsCache, vars) > MAX_DEBTS_AS_COLLATERAL) revert UsedTooMuchDebtAsCollateral();

Meant to limit the amount of debt tokens used as collateral

https://github.com/blkswnStudio/ap/blob/8fab2b32b4f55efd92819bd1d0da9bed4b339e87/packages/contracts/contracts/RedemptionOperations.sol#L251-L258

    vars.collLots = _includePendingRewards
      ? troveManager.getTroveWithdrawableColls(_borrower)
      : troveManager.getTroveColl(_borrower);
    for (uint i = 0; i < vars.collLots.length; i++) {
      uint p = priceFeed.getUSDValue(_priceCache, vars.collLots[i].tokenAddress, vars.collLots[i].amount);
      vars.troveCollInUSD += p;
      if (!tokenManager.isDebtToken(vars.collLots[i].tokenAddress)) vars.redeemableTroveCollInUSD += p;
    } /// @audit can change the ratio of a trove to have mostly `isDebtToken` debt | How does this relate to collateral?

Redemptions do not allow redeeming debt tokens used as collateral, meaning that after a redemption the ratio of debt used as collateral will increase, potentially going above the threshold

Mitigation

I'm unsure wether the MAX_DEBTS_AS_COLLATERAL check is necessary, however if you wish to enforce it, redemptions, liquidations and adjusting of Troves will need to be altered

sambP commented 2 months ago

That is not an issue. The intetion was to stop new minting out of the trove if it has too much debt as collateral.