VIS-2 / taobank-04-24

0 stars 0 forks source link

No check for sequencer uptime can lead to dutch auctions executing at bad prices #8

Open DanailYordanov opened 5 months ago

DanailYordanov commented 5 months ago

Impact

Severity: Medium Likelihood: Low

Context

AuctionManager::bid()

Description

There is no check for sequencer uptime, which could lead to auctions executing at unfavorable prices for the protocol. While the auctions are automatically closed after 2 hours (auctionDuration), a dutch auction which starts at _highestDebtToAuction and ends at _lowestDebtToAuction, in case of a sequencer outage, would never had a chance to fill at a higher price during the outage. While this doesn't result in bad debt for the protocol, it's beneficial for auctions to execute at higher prices during stable market conditions, as more stable tokens are removed from circulation.

  1. Alice borrows 2500 stable coins (maximum borrowable) in exchange for 1 WETH worth $3000.
  2. A small price movement decreases her health factor to just below 1e18 (approximately ~0.99e18), making her position liquidatable.
  3. A 2-hour Dutch auction is initiated for her collateral, but a sequencer outage occurs simultaneously. During the 1.5-hour outage, the price decreases.
  4. When the sequencer comes online, Bob can redeem Alice's collateral for a lower price.
  5. Fewer stable coins are burnt compared to if the sequencer had not gone offline.

Recommendation

Implement a check for sequencer uptime and invalidate the auction if the sequencer was down during the auction period, provided the position's health factor hasn't significantly decreased. In volatile times, it's preferable to liquidate positions quickly rather than restart auctions to avoid the protocol incurring underwater debt.

DanailYordanov commented 5 months ago

Za tova ne sum napulno siguren kakuv e impact-a i dali e valid issue, moje da se izvurti da e valid, shte mi trqbva oshte malko da pomislq kolko e losho che auction-a se e izpulnil na lowest debt

DanailYordanov commented 5 months ago

Sushto taka potencialen lead e, kakvo shte stane ako health factora padne tolkova rapid, che realno value-to na poziciqta stane po-malko ot _lowestDebtToAuction, obache ima primerno 1 chas ot auction-a, koeto e kluchovo za poziciqta da ne se prevurne v bad debt

0xMilenov commented 5 months ago

тва още няма да го слагам в ишутата в таобанк, като го пруувнеш направо може да го добавиш бтв

DanailYordanov commented 4 months ago

ne go submitvai oshte, opravil sum go, mislq che tova ima kak da mine za medium, ako ne pak info shte e, prosto trqbv da doopravq tova s Alice i Bob scenario i da go mina prez chatgtp