Submitted by Saintcode_, also found by T1MOH and falconhoof
The AccountingEngine.sol contract serves as the protocols central component responsible for initializing both debt and surplus auctions. Debt auctions are consistently initiated with a predefined minimum bid referred to as debtAuctionBidSize. This is done to ensure that the protocol can only auction debt that is not currently undergoing an auction and is not locked within the debt queue, as articulated in the comment found on IAccountingEngine:248: It can only auction debt that has been popped from the debt queue and is not already being auctioned. This necessity prompts the check on AccountingEngine:181:
if (_params.debtAuctionBidSize > _unqueuedUnauctionedDebt(_debtBalance))
This check verifies that there is a sufficient amount of bad debt available to auction.
The issue stems in line 183, where _settleDebt is called, this aims to ensure that only bad debt is considered for the auction. However, if the remaining bad debt, after settlement, falls below the specified threshold (debtAuctionBidSize <= unqueuedUnauctionedDebt()), the auction still starts with an incorrect amount of bad debt coverage, diluting the protocol Token when it is not yet needed.
Non-existent debt gets auctioned when it is not necesary which dilutes the protocol token.
The attached Proof of Concept (PoC) demonstrates two test cases:
The following tests have been created using the protocols test suite:
First test case (original two call flow):
Second test case (vulnerability):
Both test cases should revert and not let a user create a debt Auction under insufficient debt circumstances, but as stated on the report the second test case succeeds and creates the Auction.
To mitigate this risk, I suggest introducing the check (_params.debtAuctionBidSize > _unqueuedUnauctionedDebt(_debtBalance)) after calling _settleDebt to ensure there exists enough amount of bad in the contract after the settling.
RaymondFam (Lookout) commented:
MiloTruck (Judge) commented:
pi0neerpat (OpenDollar) commented
