Submitted by minhquanym
In a redistribution, the unhealthy troves collateral and debt is distributed among troves proportionally to its collateral composition. If no other troves have deposited a yang that is to be redistributed, then the debt and value attributed to that yang will be redistributed among all other yangs in the system, according to their value proportionally to the total value of all remaining yangs in the system.
However, the Opus protocol allows anyone to deposit into any trove, even if they are not the troves owner, as seen in the function abbot.deposit(). This feature could potentially be exploited by an attacker. For instance, if a yang is only deposited in one trove thats being redistributed, the attacker could deposit a small amount into a victims trove. This could result in all bad debt being redistributed to the victims trove instead of exceptional redistribution, even if the victim didnt want this (i.e., they didnt deposit this yang into their trove).
Consider the following scenario:
Limit deposits to only the troves owner.
tserg (Opus) acknowledged, but disagreed with severity and commented:
0xsomeone (judge) decreased severity to Medium and commented:
