---
# System prepended metadata

title: PRISMA 1 - Dan Ogurtsov

---

# Prisma 1 - Dan Ogurtsov


### 2.1 Critical

Not found


### 2.2 High

Not found

### 2.3 Medium


#### 1. Users with large troves can drop TCR below 150% and receive privileged positions to liquidate others. 

##### Description

The attack flow:

0. Start ETH price is 2000 USD/ETH
1. Attacker opens a large trove with the minimal debt - deposits 1000 ETH, borrows 500 USD. ICR is 400 000 %. TCR is 400 000 % (assume our attacker is the first depositor).
2. User A deposits 100 ETH, borrows 143k USD. ICR = 140%. TCR = 1533%.

> TCR is far from Recovery Mode, 
> so User A does not expect liquidation.
4. Attacker waits for any Chainlink update down. Like from 2000 to 1999.9
5. Attacker creates a bundle in Flashbots with the sequence:
```
1. Attacker withdraws all possible collateral,`
so that TCR does not fall below 150%, 
but very close, like 150.000001%.
In our case, withdraw 892.3749993 ETH
2. Small Chainlink update. 
TCR falls below 150% = 149.992501 %
Recovery mode is active.
3. Attacker liquidates User A, as ICR is below 150%
```
6. Attacker receives:
    gas_compensation
    +
    0.5% * 78.654 ETH 
    = 0.393 ETH + 200 USD
7. Attacker adds collateral and waits for new victims

As a result, the attacker manipulated TCR and took a privileged position to liquidate users with TCR below 150%.
The limitation of the attack is that it requires few users with ICR above 150%.

#### Recommendation

This attack is hard to mitigate. One of the options to align chances to liquidate - is to disallow liquidations in the block when the recent Chainlink update happened.


### 2.4 Low

#### 1. Flashmint max amount check is easily bypassed

##### Description

Users can take two or more flashloans and bypass the requirement of `maxFlashLoan()` size.
- https://github.com/prisma-fi/prisma-contracts/blob/52b26b8a2f1904b048754d5443e08d2144610b92/contracts/core/DebtToken.sol#L155C14-L157

Current cap for flashloans is set to `2**128`.
If this check aims to limit flashloan amount in order not to exceed max totalSupply, take into account that OpenZeppelin´s ERC20 will not allow new totalSupply overflow `2**256` limit.
- https://github.com/OpenZeppelin/openzeppelin-contracts/blob/f29307cfe08c7d76d96a38bf94bab5fec223c943/contracts/token/ERC20/ERC20.sol#L243

#### Recommendation

We recommend either removing this check or introducing a reentrancy protection for the flashloan function only. 


#### 2. callerOrDelegated specification is not followed for CloseTrove

##### Description

For all key functions in `BorrowerOperations` users can choose their privileged address to delegate operation.
- https://github.com/prisma-fi/prisma-contracts/blob/52b26b8a2f1904b048754d5443e08d2144610b92/contracts/dependencies/DelegatedOps.sol#L22-L29

Comment there states that:
```
In executing the call, 
all internal state updates 
should be applied for `account` 
and all value transfers 
should occur to or from the caller.
```
It is not the case for `closeTrove()`.
- https://github.com/prisma-fi/prisma-contracts/blob/52b26b8a2f1904b048754d5443e08d2144610b92/contracts/core/BorrowerOperations.sol#L393-L398
Here the contract closes the trove taking debtToken from `msg.sender` (as it should), but the remaining collateral is sent to `account`, so the specification is not followed.

##### Recommendation

We recommend either sending collateral to `msg.sender` or fixing the comment describing the desired behavior.




#### 3. During the global pause users can increase and decrease TCR

##### Description

We have two contracts that check the global pause:
- BorrowerOperations.sol (BO)
- StabilityPool.sol (SP)

These contracts have the following functions for users and sometimes they are allowed to be called during the global pause.

function | allowed on pause ?
--- | ---
BO.openTrove() | no
BO.addColl() | no
BO.withdrawCall() | yes
BO.withdrawDebt() | no
BO.repayDebt() | yes
BO.adjustTrove() | allowed if adjusted to [no more collateral] & [less debt]
BO.closeTrove() | yes
SP.provideToSP() | no
SP.withdrawFromSP() | yes

Withdrawing collateral makes TCR lower.
Repaying debt makes TCR higher
Closing troves makes TCR lower, likely.

As a result, the "pause" does not serve as a true global pause and does not stop all operations.

##### Recommendation

We recommend ensuring that this pause behavior is enough and complete. If the project needs a true global pause, we recommend introducing a new type of pause that stops all functions.



#### 4. TroveManager bytecodes are not recommended to be different

##### Description

`Factory` allows selecting any implementation addresses for `TroveManager` and `SortedTroves`.
- https://github.com/prisma-fi/prisma-contracts/blob/52b26b8a2f1904b048754d5443e08d2144610b92/contracts/core/Factory.sol#L83-L84

The problem is that TroveManagers are not completely separated and the TCR calculation is made through iterating through each TroveManager. Thus the issue in one TroveManager can break the whole system. That is why it is risky that potentially not audited implementations are allowed.

##### Recommendation

We recommend ensuring that all connected TroveManagers share the same code. It is better to have new features separated from the audited codebase, e.g. in v2 of the protocol.



#### 5. MCR and CCR management

##### Description

MCR and CCR are constants:
- https://github.com/prisma-fi/prisma-contracts/blob/52b26b8a2f1904b048754d5443e08d2144610b92/contracts/dependencies/PrismaBase.sol#L13-L17

Over time, the value and volatility of the collateral token may change. It will require adapting MCR and CCR to new market behavior.

##### Recommendation

We recommend that you add methods for changing MCR and CCR parameters.

