sherlock-audit / 2023-01-ajna-judging

1 stars 0 forks source link

Jeiwan - Incorrect MOMP calculation in neutral price calculation #148

Open github-actions[bot] opened 1 year ago

github-actions[bot] commented 1 year ago

Jeiwan

medium

Incorrect MOMP calculation in neutral price calculation

Summary

When calculating MOMP to find the neutral price of a borrower, borrower's accrued debt is divided by the total number of loans in the pool, but it's total pool's debt that should be divided. The mistake will result in lower neutral prices and more lost bonds to kickers.

Vulnerability Detail

As per the whitepaper:

MOMP: is the price at which the amount of deposit above it is equal to the average loan size of the pool. MOMP is short for “Most Optimistic Matching Price”, as it’s the price at which a loan of average size would match with the most favorable lenders on the book.

I.e. MOMP is calculated on the total number of loans of a pool (so that the average loan size could be found).

MOMP calculation is implemented correctly when kicking a debt, however it's implementation in the Loans.update function is not correct:

uint256 loansInPool = loans_.loans.length - 1 + auctions_.noOfAuctions;
uint256 curMomp     = _priceAt(Deposits.findIndexOfSum(deposits_, Maths.wdiv(borrowerAccruedDebt_, loansInPool * 1e18)));

Here, only borrower's debt (borrowerAccruedDebt_) is divided, not the entire debt of the pool.

Impact

The miscalculation affects only borrower's neutral price calculation. Since MOMP is calculated on a smaller debt (borrower's debt will almost always be smaller than total pool's debt), the value of MOMP will be smaller than expected, and the neutral price will also be smaller (from the whitepaper: "The NP of a loan is the interest-adjusted MOMP..."). This will cause kickers to lose their bonds more often than expected, as per the whitepaper:

If the liquidation auction yields a value that is over the “Neutral Price,” NP, the kicker forfeits a portion or all of their bond.

Code Snippet

Loans.sol#L113-L114

Tool used

Manual Review

Recommendation

Consider using total pool's debt in the MOMP calculation in Loans.update.