Submitted by SBSecurity, also found by peanuts, Emmanuel, carlitox477, Stefanov, AlexCzm, carrotsmuggler, d3e4, and grearlake
When a liquidator liquidates a user, he will pay his debt and must receive the debt + 20% bonus in form of collateral (from the user). But now the 20% bonus is based on the users (collateral - debt), which removes the entire incentive for liquidation.
From Docs:
Note: to view the provided image, please see the original submission here.
liquidate() will first check if the user with the supplied id is for liquidation, then take the users debt to cover from mintedDyad and burn it from the liquidators balance. From there, the calculation of the liquidation bonus begins.
Lets look at this example (same as in the test below):
But it will actually calculate 20% of (UserA collateral - UserA debt), which in this case would be 20% of $35 = $7.
This 0.79e18, or more precisely 107/135 is how much of users collateral the liquidator will receive and that is $135 * (107/135) = $107.
As we can see for $100 repaid he will only get $7 collateral bonus collateral, which confirms our state that the 20% bonus is based on (UserA collateral - UserA debt).
The test will cover the same as case we explained above.
In order to execute the test:
The bonus should be based on the burned user debt and then must send the liquidator the percentage of liquidated user collateral equal to the burned debt + 20% bonus.
This is an example implementation, which gives the desired 20% bonus from the right amount, but need to be tested for further issues.
Math
shafu0x (DYAD) acknowledged and commented via duplicate Issue #75:
Koolex (judge) decreased severity to Medium
