Ammalgam-1 Fixes

Code Freeze: 65d8558e068f3ecf4cff03db158c8996ecbe1402

Context

Trusted Entities:

• FeeToSetter: Has the permission to set the address that will receive protocol fees in the factory. Trusted that they will set the FeeTo address will be set to an address owned by Ammalgam team
• FeeTo address: Set by the FeeToSetter, and will receive protocol fees across all Ammalgam pairs. It is trusted this address will use the funds appropriately and in benefit to the Ammalgam protocol.
• PluginRegistry owner: Responsible for setting approved plugins that users can add to their accounts. It is trusted new plugins will consume a reasonable amount of gas and their addition would benefit users.

Issues Found

[C-1] Repayment of debt can be skipped in hard liquidations

There are 3 different types of liquidations, hard, soft and leverage, that can be specified when calling liquidate(). In the case of a hard liquidation where debt is directly paid and collateral is transferred to the liquidator at a discount to incentivize the liquidator. This functionality is handled by liquidateHard(). Instead of the protocol directly calculating the the amount of assets to transfer to the liquidator or assets to repay debt, these parameters are provided by the liquidator and verified to be correct via Liquidation.checkHardDiscounts() which calculates the max liquidator discount given the account, and compares this discount with the discount being requested based on the inputed repay and deposit asset parameters. Repayment can occur using X/Y tokens, and or repayment in the Liquidity tokens LX and LY, with each being handled differently. In the case of repayment with LX and LY, it is required and expected that both tokens are payed at once:

if (0 < repayLXInXAssets && 0 < repayLYInYAssets) {
    repayCallback(repayLXInXAssets, repayLYInYAssets);
    (uint256 actualRepaidLXInXAssets, uint256 actualRepaidLYInYAssets,) = _repayLiquidity(borrower);

    // check that at least promised amount was repaid
    verifyRepay(actualRepaidLXInXAssets, repayLXInXAssets, actualRepaidLYInYAssets, repayLYInYAssets);
}

Reference: AmmalgamPair.sol#L760-766

However, this assumes that both repayLXInXAssets and repayLYInYAssets are greater than zero, in the case where only one is greater than zero, it will skip this branch and thus skip the repayment step entirely, jumping directly to transferring assets to the liquidator. This allows anyone to drain assets from the protocol, creating bad debt and resulting in potential insolvency.

Remediations to Consider

Ensure that both repayLXInXAssets and repayLYInYAssets if one is greater than zero to ensure repayment occurs as expected.

[H-1] Mint and burn operations should affect liquidation price and saturation