MIN_MINT_DYAD_DEPOSIT doesn't enforce any behavior on minters

[zobront]

Summary

The public mint() function includes a requirement that users must submit $5k of ETH in order to mint a new dNFT. However, there is no restriction stopping them from immediately redeeming this deposit back into ETH by calling redeemDeposit().

The only requirement is that they keep sufficient balance to avoid being liquidated, which is enforced independently from the MIN_MINT_DYAD_DEPOSIT.

The result is that a user can buy up the full supply of dNFTs for close to free, as they loop through:

• mint() => deposit $5k of ETH
• redeemDeposit() => cash out up to $5k of ETH

This becomes a greater risk depending how the liquidation() function is changed, based on #4.

Recommendations

This relies heavily on how you decide to implement liquidations, as it's unclear whether they will solve for this use case.

In the event that liquidations do not solve this problem (which is my recommendation), consider requiring a minimum number of shares (or value of deposits) that must be maintained by all dNFTs at all times. This will ensure that a fixed amount of the deposited dollars stay in the vault.

[shafu0x]

I think this is solved by the new liquidation mechanism. you could mint it in a loop like you described but all your dNFTs would be open for liquidation instantaneously.

[zobront]

I think it's the opposite, isn't it? In the new system, as long as you don't withdraw (into DYAD) and just redeem (into ETH) you'll never be liquidatable.

[shafu0x]

fixed by https://github.com/DyadStablecoin/contracts-v3/pull/25/files

[zobront]

Confirmed fix with #25, 881163c, and #30.

The deposit minimum is still not a true invariant, as a user with minimum deposits could have their deposits lowered by the price of ETH falling. However, the goal of this check is to keep users from disengaging from the system, and there is no harm done or liquidation risk from it falling below the minimum, so this accomplishes that goal.