Wrong auctionPrice used in calculating BPF to determine bond reward (or penalty)
2.In _prepareTake() function,the BPF is calculated using vars.auctionPrice which is calculated by _auctionPrice() function.\\n```\\nfunction _prepareTake(\\n        Liquidation memory liquidation_,\\n        uint256 t0Debt_,\\n        uint256 collateral_,\\n        uint256 inflator_\\n    ) internal view returns (TakeLocalVars memory vars) {\\n // rest of code// rest of code..\\n        vars.auctionPrice = _auctionPrice(liquidation_.referencePrice, kickTime);\\n        vars.bondFactor   = liquidation_.bondFactor;\\n        vars.bpf          = _bpf(\\n            vars.borrowerDebt,\\n            collateral_,\\n            neutralPrice,\\n            liquidation_.bondFactor,\\n            vars.auctionPrice\\n        );\\n```\\n\\n3.The _takeBucket() function made a judgment after _prepareTake()\\n```\\n // cannot arb with a price lower than the auction price\\nif (vars_.auctionPrice > vars_.bucketPrice) revert AuctionPriceGtBucketPrice();\\n// if deposit take then price to use when calculating take is bucket price\\nif (params_.depositTake) vars_.auctionPrice = vars_.bucketPrice;\\n```\\n\\nso the root cause of this issue is that in a scenario where a user calls Deposit Take(params_.depositTake ==true) ,BPF will calculated base on vars_.auctionPrice instead of bucketPrice.\\n```\\n vars_ = _calculateTakeFlowsAndBondChange(\\n            borrower_.collateral,\\n            params_.inflator,\\n            params_.collateralScale,\\n            vars_\\n        );\\n// rest of code// rest of code// rest of code// rest of code.\\n_rewardBucketTake(\\n            auctions_,\\n            deposits_,\\n            buckets_,\\n            liquidation,\\n            params_.index,\\n            params_.depositTake,\\n            vars_\\n        );\\n```\\n
In the case of Deposit Take calculate BPF using bucketPrice instead of auctionPrice .
Wrong auctionPrice used in calculating BFP which subsequently influences the _calculateTakeFlowsAndBondChange() and _rewardBucketTake() function will result in bias .\\nFollowing the example of the Whitepaper(section 7.4.2 Deposit Take)： BPF = 0.011644 * (1222.6515-1100 / 1222.6515-1050) = 0.008271889129 The collateral purchased is min{20, 20000/(1-0.00827) * 1100, 21000/(1-0.01248702772 )* 1100)} which is 18.3334 unit of ETH .Therefore, 18.3334 ETH are moved from the loan into the claimable collateral of bucket 1100, and the deposit is reduced to 0. Dave is awarded LPB in that bucket worth 18. 3334 · 1100 · 0. 008271889129 = 166. 8170374 𝐷𝐴𝐼. The debt repaid is 19914.99407 DAI\\n\\nBased on the current implementations: BPF = 0.011644 * (1222.6515-1071.77 / 1222.6515-1050) = 0.010175. TPF = 5/4*0.011644 - 1/4 *0.010175 = 0.01201125. The collateral purchased is 18.368 unit of ETH. The debt repaid is 20000 * (1-0.01201125) / (1-0.010175) = 19962.8974DAI Dave is awarded LPB in that bucket worth 18. 368 · 1100 · 0. 010175 = 205.58 𝐷𝐴𝐼.\\nSo,Dave earn more rewards（38.703 DAI） than he should have.\\nAs the Whitepaper says: " the caller would typically have other motivations. She might have called it because she is Carol, who wanted to buy the ETH but not add additional DAI to the contract. She might be Bob, who is looking to get his debt repaid at the best price. She might be Alice, who is looking to avoid bad debt being pushed into the contract. She also might be Dave, who is looking to ensure a return on his liquidation bond."
```\\nfunction _prepareTake(\\n        Liquidation memory liquidation_,\\n        uint256 t0Debt_,\\n        uint256 collateral_,\\n        uint256 inflator_\\n    ) internal view returns (TakeLocalVars memory vars) {\\n // rest of code// rest of code..\\n        vars.auctionPrice = _auctionPrice(liquidation_.referencePrice, kickTime);\\n        vars.bondFactor   = liquidation_.bondFactor;\\n        vars.bpf          = _bpf(\\n            vars.borrowerDebt,\\n            collateral_,\\n            neutralPrice,\\n            liquidation_.bondFactor,\\n            vars.auctionPrice\\n        );\\n```\\n