0x73696d616f - Anyone can trigger `VaultLib::_liquidatedLp()` which does not call `lvRedeemRaWithCtDs()` with the correct amount and will lead to incorrect withdrawals and stuck funds
Audit: 2024-08-cork-protocol-judging
Severity: HIGH

0x73696d616f

High

# Anyone can trigger `VaultLib::_liquidatedLp()` which does not call `lvRedeemRaWithCtDs()` with the correct amount and will lead to incorrect withdrawals and stuck funds

### Summary

[VaultLib::_liquidatedLp()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L349) is triggered when the expiry date is reached, by calling [VaultLib::redeemExpired()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L514) or [VaultLib::onNewIssuance()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L92). The purpose is liquidating all the assets and turn them into withdrawable funds for users, by calling [VaultPoolLib::reserve()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L392) and adding funds [self.withdrawalPool and self.ammLiquidityPool](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultPoolLib.sol#L21-L32).

However, there is a bug with the [redeemAmount](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L376) passed to [PsmLib::.lvRedeemRaWithCtDs()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L377), as it will always be 0 due to [FlashSwapRouter::emptyReserve()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L374) always returning [0](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/flash-swaps/FlashSwapRouter.sol#L70), which means Ra will never be redeemed for `Ct` and `Ds`. 

It returns `0` because [DsFlashSwap::emptyReserve() ](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/DsFlashSwap.sol#L67) calls [DsFlashSwap::emptyReservePartial()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/DsFlashSwap.sol#L67) with the full reserve, `self.ds[dsId].reserve` and `DsFlashSwap::emptyReservePartial()` returns the reserve [post reduction](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/DsFlashSwap.sol#L77), which is 0 in this case.

Additionally, the same logical error happens in [VaultLib::_redeemCtDsAndSellExcessCt()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L329), which in this case means the [ctSellAmount](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L334) will be bigger than it should and it will try to [sell](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/VaultLib.sol#L345) more `ct` than