Upgraded Q -> 2 from #1121 [1715338217668]

[c4-judge]

Judge has assessed an item in Issue #1121 as 2 risk. The relevant finding follows:

[L-04] Funding Exogenous vaults manipulate kerosine price kerosine value should represent degree of DYAD’s overcollateralization. as its value is determined using the total DYAD minted and the total value Locked.

Vault.kerosine.unbounded.sol#L60-L65

function assetPrice() ... returns (uint) { ... for (uint i = 0; i < numberOfVaults; i++) { Vault vault = Vault(vaults[i]); <@ tvl += vault.asset().balanceOf(address(vault))

• vault.assetPrice() 1e18 / (10vault.asset().decimals()) / (10vault.oracle().decimals()); } uint numerator = tvl - dyad.totalSupply(); uint denominator = kerosineDenominator.denominator(); return numerator 1e8 / denominator; } But the problem here is that balanceOf thinks that all the balance in the vault is used as collateral for DYAD.

If we donate the vaults, the donated funds will not be collateral funds, as they will be locked inside the Vault contract (can not be used to mint DYAD). This will make kerosine price deviate from the correct value it should represent (over-collateralization ratio), where the token price (kerosine) will increase thinking that there are a lot of collaterals for the stablecoin (DYAD), but in reality, these funds are locked in vaults and do not represent DYAD collaterals.

Recommendations It can be left as it is, as there are no impacts that can occur for that in my opinion. However, if the developers are interested in mitigation, they can track the balance internally.

[c4-judge]

This auto-generated issue was withdrawn by koolexcrypto

[c4-judge]

koolexcrypto marked the issue as grade-c