ltyu - End epoch can be triggered when null epoch

[sherlock-admin]

ltyu

high

End epoch can be triggered when null epoch

Summary

The function triggerEndEpoch can be called even when an epoch is considered null i.e., either premium or collateral vaults are empty.

Vulnerability Detail

An epoch is considered null if either premium or collateral vaults are empty. Currently, triggerNullEpoch() can be called to 1) zero out the claimTVL for the empty vault, and 2) set the claimTVL to finalTVL of the occupied vault. Essentially, this refunds the occupied vault.

However, it is possible to call triggerEndEpoch() when there is a null event. This is problematic because calling triggerEndEpoch(), will resolve as a non-depeg event has occurred. In other words, premium will be paid to collateral (fee will be assessed too). In this particular case, if the collateral vault is empty, the premium vault will lose all their deposits.

Impact

This is high impact because an adversary can front-run triggerNullEpoch() and call triggerEndEpoch() instead. This will result in lost funds. If there are no deposits into the collateral vault, premiums will be lost as there will be no one to withdraw. If it is a Carousel, emissions will be lost too.

Code Snippet

No null epoch check in triggerEndEpoch()
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L144-L202

Here is a test for it. Add to ControllerPeggedAssetV2Test.t.sol:

contract ControllerPeggedAssetV2Test is Helper, ERC1155Holder {
      function testTriggerEndEpochWhenNull() public {
              vm.startPrank(address(this));
              MintableToken(UNDERLYING).approve(premium, 2);
              VaultV2(premium).deposit(epochId, 2, address(this));
              vm.stopPrank();
      
              // Prem has 2 assets, and collateral has 0
              assertEq(VaultV2(premium).totalAssets(epochId), 2);
              assertEq(VaultV2(collateral).totalAssets(epochId), 0);
              assertEq(VaultV2(premium).claimTVL(epochId), 0);
              assertEq(VaultV2(collateral).claimTVL(epochId), 0);
              vm.warp(end + 1);
              controller.triggerEndEpoch(marketId, epochId);

              // Claimable for collateral vault has increased
              assertEq(VaultV2(premium).claimTVL(epochId), 0);
              assertEq(VaultV2(collateral).claimTVL(epochId), 2);
      }
}

Tool used

Manual Review

Recommendation

• Consider adding a null epoch check similar to triggerDepeg

Duplicate of #108