Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

Latest commit

 

History

History
35 lines (23 loc) · 2.21 KB

318.md

File metadata and controls

35 lines (23 loc) · 2.21 KB
Raw

neumo

high

Protocol assumes UXD is pegged to USDC

Summary

When depositing dollar-pegged stablecoins trough Rage Trade and Perpetual, the protocol mints to the user the exact amount of USDC deposited. This assumption of the deposited stablecoin price being equal to that of UXD is dangerous because, as we've seen in the past, a big depeg of the stablecoin could cause UXD to collapse.

Vulnerability Detail

Perpetual protocol depository, when depositing, returns the same quoteAmount from the swap to mint redeemable to the user. https://github.com/sherlock-audit/2023-01-uxd/blob/main/contracts/integrations/perp/PerpDepository.sol#L240-L253 https://github.com/sherlock-audit/2023-01-uxd/blob/main/contracts/integrations/perp/PerpDepository.sol#L330-L344

In the case of Rage Trade, the depository has two functions to deposit and redeem, which both return the same amount deposited (normalized to redeemable decimals).

https://github.com/sherlock-audit/2023-01-uxd/blob/main/contracts/integrations/rage-trade/RageDnDepository.sol#L99-L138 This makes both depositories only compatible with dollar-peg stablecoins (in the case of Perpetual, the quote token should be a stablecoin while the asset token can be any).

Although the initial plans of the protocol is to use USDC, many others could be used like USDT, DAI, etc, and assuming the price of this will be equal to the price of UXD is dangerous. In the case of DAI, for instance, there are discussions to depeg the coin in the future, and this would break all depositories dependant of this stablecoin (sources https://coinmash.co/maker-dao-co-founder-believes-dai-should-drop-its-dollar-peg/, https://protos.com/explained-makerdaos-plan-to-break-the-dollar-peg/).

Impact

High impact.

Code Snippet

https://github.com/sherlock-audit/2023-01-uxd/blob/main/contracts/integrations/perp/PerpDepository.sol#L240-L253 https://github.com/sherlock-audit/2023-01-uxd/blob/main/contracts/integrations/perp/PerpDepository.sol#L330-L344 https://github.com/sherlock-audit/2023-01-uxd/blob/main/contracts/integrations/rage-trade/RageDnDepository.sol#L99-L138

Tool used

Manual review

Recommendation

Use an oracle to get the relative price of UXD and the stablecoin and mint UXD accordingly.