DYAD

Stablecoin + Endogenous Collateral|1,500 LOC|10H + 9M = 19 findings|Repo

Tool Results

Green findings count as true positives and recall. Yellow means a possible match that is shown for review but does not count toward precision or recall. Red means no official finding matched.

Official Findings (19)

H-01Design flaw and mismanagement in vault licensing leads to double counting in collateral ratios and positions collateralized entirely with kerosine

H-02Inability to perform partial liquidations allows huge positions to accrue bad debt in the system

H-03Attacker can make 0 value deposit() calls to deny user from redeeming or withdrawing collateral

H-04Attacker can frontrun user's withdrawals to make them revert without costs

H-05Unable to withdraw Kerosene from VaultManagerV2::withdraw as it expects a vault.oracle() method which is missing in Kerosene vaults

H-06User can get their Kerosene stuck because of an invalid check on withdraw

H-07Missing enough exogenous collateral check in VaultManagerV2::liquidate makes the liquidation revert even if DYAD minted is greater than non-Kerosene value

H-08Users can get their Kerosene stuck until TVL becomes greater than DYAD's supply

H-09Kerosene collateral is not being moved on liquidation, exposing liquidators to loss

H-10Flash loan protection mechanism can be bypassed via self-liquidations

M-01Liquidation bonus logic is wrong

M-02No incentive to liquidate when CR <= 1 as asset received is less than DYAD burned

M-03setUnboundedKerosineVault not called during deployment, causing reverts when querying for Kerosene value after adding it as a Kerosene vault

M-04Liquidating positions with bounded Kerosene could be unprofitable for liquidators

M-05No incentive to liquidate small positions could result in protocol going underwater

M-06Attacker can frontrun to prevent vaults from being removed from the dNFT owner's position

M-07VaultManagerV2.sol::burnDyad function is missing an isDNftOwner modifier, allowing a user to burn another user's minted DYAD

M-08Incorrect deployment or missing contract will break functionality

M-09Value of Kerosene can be manipulated to force liquidate users