libratus - Missing null epoch check in triggerEndEpoch

[sherlock-admin]

libratus

medium

Missing null epoch check in triggerEndEpoch

Summary

There is no check for zero TVL in triggerEndEpoch meaning that null epoch can be treated like a normal one

Vulnerability Detail

If any vault's TVL is zero the epoch is not considered valid and the funds are given back to depositors. No fees are taken and no balance transfers are made between the vaults. From triggerNullEpoch:

        if (premiumVault.totalAssets(_epochId) == 0) {
            premiumVault.resolveEpoch(_epochId);
            collateralVault.resolveEpoch(_epochId);

            premiumVault.setClaimTVL(_epochId, 0);
            collateralVault.setClaimTVL(
                _epochId,
                collateralVault.finalTVL(_epochId)
            );

            collateralVault.setEpochNull(_epochId);
        } else if (collateralVault.totalAssets(_epochId) == 0) {
            premiumVault.resolveEpoch(_epochId);
            collateralVault.resolveEpoch(_epochId);

            premiumVault.setClaimTVL(_epochId, premiumVault.finalTVL(_epochId));
            collateralVault.setClaimTVL(_epochId, 0);

            premiumVault.setEpochNull(_epochId);
        } else revert VaultNotZeroTVL();

However, it is also possible to call triggerEndEpoch, because this function does not check whether there is a vault with 0 TVL. It will take fees and transfer premium to collateral vault. This is vastly different from triggerNullEpoch behavior.

Let's say the epoch is invalid because there are no deposits to collateral vault. If triggerEndEpoch is called, premium depositors lose their funds as those will be transferred to collateral vault. On the other hand, with triggerNullEpoch they would have gotten them back since the epoch would be marked invalid.

Impact

Premium depositors will not get their funds back in case of null epoch

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L232-L251

Tool used

Manual Review

Recommendation

Revert triggerEndEpoch if either of the vaults has no deposits

Duplicate of #108