Summary
The objective of this proposal is to do an upgrade of the params contract. The current calculation of total deposit incorporates debt owed by Credit Manager to the Red Bank, which can be abused to deposit more assets than the cap allows. To address this issue, a proposed mitigation involves excluding the debt component from the total deposit formula.
Motivation
Currently the total deposit for an asset is calculated as follows:
total_deposit = rb_deposit + cm_deposit - cm_debt_in_rb
Where:
- rb_deposit - deposited asset in Red Bank.
- cm_deposit - deposited asset in Credit Manager.
- cm_debt_in_rb - asset debt Credit Manager owes to Red Bank.
Let’s consider a scenario where User A deposits 100 USDC into Red Bank. User B, from the Credit Manager account, borrows 10 USDC and lends it to Red Bank. The deposit cap is set at 100 USDC.
In this situation:
- Red Bank’s deposit (rb_deposit) is 110 USDC consisting of 100 USDC from User A plus 10 USDC lent by User B.
- Credit Manager’s deposit (cm_deposit) is 0 USDC.
- Credit Manager’s debt in Red Bank (cm_debt_in_rb) is 10 USDC (representing the amount borrowed by User B).
- The total deposit in Red Bank is calculated as 100 + 10 + 0 - 10 = 100 USDC.
User B can repeat this process multiple times (borrow and lend repeatedly) without surpassing the deposit cap. This allows the user to “artificially” inflate the deposit in Red Bank, even though it essentially involves transferring 10 USDC from the existing deposit in Red Bank.
We propose to mitigate the issue by removing cm_debt_in_rb from total_deposit formula:
total_deposit = rb_deposit + cm_deposit
This change would prevent the artificial increase in the deposit and ensure that the total deposit is based solely on the actual deposits in Red Bank and Credit Manager.
Risks
This change introduces smart contract code changes, the risk in making changes to the smart contracts are that while the code changes are minor, new bugs or unforeseen situations as a result of the changes can occur.
Implementation
This upgrade updates the formula for total deposit query in params contract.
The changes can be viewed in the release.
This is a signaling proposal, not an executable proposal.
The Mars smart contracts on the Osmosis chain are currently controlled by the Builder Multisig address. If this proposal passes, the builders will utilize their multisig to make the necessary parameter changes.
Copyright
Copyright and related rights waived via CC0.
Disclaimers/Disclosures
This proposal is being made by Delphi Labs Ltd., a British Virgin Islands limited company. Delphi Labs engages in incubation, investment, research and development relevant to multiple ecosystems and protocols, including the Mars Protocol. Delphi Labs and certain of its service providers and equity holders own MARS tokens and have financial interests related to this proposal. Additionally, Delphi Labs is one of several entities associated with one another under the “Delphi Digital” brand. Delphi Digital’s associated entities and/or equityholders or service providers of such entities may hold MARS and may have financial interests related to this proposal. All such entities, service providers, equity holders and other related persons may also have financial interests in complementary or competing projects or ecosystems, entities or tokens, including Osmosis/OSMO and Celestia/TIA. Delphi Ventures, a related company, is an investor in rights to receive TIA. These statements are intended to disclose relevant facts and to help identify potential conflicts of interest, and should not be misconstrued as a complete description of all relevant interests or conflicts of interests; nor should they be construed as a recommendation to purchase or acquire any token or security.
This proposal is also subject to and qualified by the Mars Disclaimers/Disclosures. Delphi Labs may lack access to all relevant facts or may have failed to give appropriate weighting to available facts. Delphi Labs is not making any representation, warranty or guarantee regarding the accuracy or completeness of the statements herein, and Delphi Labs shall have no liability in the event of losses or damages ensuing from approval or rejection or other handling of the proposal. Each user and voter should undertake their own research and make their own independent interpretation and analysis of all relevant facts and issues to arrive at their own personal determinations of how to vote on the proposal.