Inaccurate Collateralization Ratio Due to Off-Peg DYAD Token

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L205-L228 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L230-L239 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L241-L248 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L250-L267 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L269-L286

Vulnerability details

Impact

An off-peg DYAD can result in premature or delayed liquidations. If DYAD's value is inflated, under-collateralized vaults may not be liquidated, posing a risk to the system's integrity. Conversely, if DYAD's value is deflated, vaults may be liquidated unnecessarily, causing undue loss to users.

Proof of Concept

Let's consider a scenario where the DYAD token's price deviates significantly from its pegged value, leading to off-peg conditions. This could occur due to various factors such as market speculation, liquidity issues, or external events impacting the token's value.

In the VaultManagerV2 contract, the off-peg DYAD scenario could affect the accuracy of USD value calculations, potentially resulting in unfair liquidations. Here's how this scenario might unfold:

1. Off-Peg DYAD Situation: Assume that the DYAD token's price deviates significantly from its pegged value due to market volatility or other factors. This means that the value of assets held as collateral (in DYAD) within the vaults may be overestimated or underestimated based on the inaccurate DYAD price.
2. Impact on USD Value Calculations: The getTotalUsdValue, getNonKeroseneValue, and getKeroseneValue functions calculate the total USD value of assets held within the vaults. However, if the DYAD token's price is off-peg, these calculations will be inaccurate because they rely on the DYAD price to convert asset values to USD.
3. Unfair Liquidation: Inaccurate USD value calculations can lead to incorrect assessments of collateralization ratios (collatRatio). This might trigger premature or unnecessary liquidations of vaults if the calculated collateralization ratio falls below the minimum threshold (MIN_COLLATERIZATION_RATIO), even if the actual collateralization level is sufficient when considering the correct DYAD price.

function getTotalUsdValue(uint id) public view returns (uint) {
    // Calculate total USD value of assets held within the vaults
    uint totalUsdValue;

    // Iterate through vaults holding non-Kerosene assets
    uint numberOfVaults = vaults[id].length(); 
    for (uint i = 0; i < numberOfVaults; i++) {
        Vault vault = Vault(vaults[id].at(i));
        uint usdValue;

        // Calculate USD value of assets in the vault using inaccurate DYAD price
        // This is simplified for demonstration purposes
        usdValue = vault.getUsdValue(id); // Incorrect calculation due to off-peg DYAD

        totalUsdValue += usdValue;
    }
    return totalUsdValue;
}

The function relies on the USD value of collateral (getTotalUsdValue(id)) and the amount of DYAD minted (_dyad). If the DYAD token's value is off-peg, the USD value of the minted DYAD does not reflect the true debt, leading to an inaccurate collateralization ratio. This ratio is critical for ensuring the system's solvency and triggering liquidations when necessary.

Tools Used

Manual

Recommended Mitigation Steps

Implement a mechanism to monitor and enforce the peg of the DYAD token. This could involve a combination of on-chain and off-chain solutions, such as using a reliable oracle to provide the current peg value and adjusting the minting and redemption

Assessed type

Context

[c4-pre-sort]

JustDravee marked the issue as sufficient quality report

[0xMax1]

The value of DYAD in external pools is not relevant to the system. Arbitrage opportunities may arise. Feature, not bug.

@shafu0x I suggest we label issue 610 as sponsor disputed.

[c4-judge]

koolexcrypto marked the issue as unsatisfactory: Invalid