Protocol is served as zero-slippage liquidity pool for stable coins

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/StableVault.sol#L27

Vulnerability details

Impact

Currently, protocol allows swap between stable coins like USDT, DAI, tigUSD at rate 1-1 all the time. While in reality, value of these tokens are not stayed the same, even for USDT-USDC, USDC usually has higher value than USDT.

Serving as zero-slippage pool for stable coins will usually make depositors losing funds and left the pool with single token. Everyone will deposit low value token and withdraw high value one. And the result is honest users, who only deposit tokens to Vault without acknowledge this is usually the one suffering loss.

Also, it increased the chance of tigUSD got depegged because to be honest, it's a new token with lowest trust among these stable coins so most of the time, Vault will only contains tigUSD.

Proof of Concept

Consider the scenario

There is a StableVault that support both USDC and DAI. Assume 1 DAI = 0.998 USDC

1. Alice deposit 1000 DAI to Stable Vault.
2. Alice withdraw 1000 USDC from Stable Vault.
3. Profit = 1000 USDC - 1000 DAI = 1000 - 0.998 * 1000 = 2 USDC

Tools Used

Manual Review

Recommended Mitigation Steps

Consider only allowing users withdraw the exact token they deposited

[GalloDaSballo]

Lack of Liquidity Premium report, definitely agree

[c4-judge]

GalloDaSballo marked the issue as duplicate of #462

[c4-judge]

GalloDaSballo changed the severity to 3 (High Risk)

[c4-judge]

GalloDaSballo marked the issue as satisfactory

[GalloDaSballo]

Invalidating due to Warden being in breach of the Rules

[c4-judge]

GalloDaSballo marked the issue as nullified