-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Balance check in _redeemBUIDL()
can cause redeem()
to fail
#267
Comments
From the docs, it should be assumed that BUIDL redeem contract is "correct" so we can assume the redeem is 1:1. I will leave for sponsor review. |
0xRobocop marked the issue as sufficient quality report |
0xRobocop marked the issue as primary issue |
Agree with " it should be assumed that BUIDL redeem contract is "correct" so we can assume the redeem is 1:1." |
cameronclifton (sponsor) disputed |
Looks like a good candidate for an analysis report. As the redeemer code is not public, we can't really prove that a BUIDL depeg is possible, so this finding doesn't hold the burden of proof. |
3docSec marked the issue as unsatisfactory: |
Lines of code
https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/ousgInstantManager.sol#L388
https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/ousgInstantManager.sol#L458
Vulnerability details
Impact
When swapping BUIDL for USDC in
_redeemBUIDL()
, balance after check can potentially cause function to revert.Proof of Concept
Users are able to
redeem()
OUSG for USDC. In cases where OUSGInstantManager.sol does not hold enough USDC, BUIDL tokens are swapped for USDC.Within
_redeemBUIDL()
, the function keeps track ofusdcBalanceBefore
to ensure that the balance afterward equalsusdcBalanceBefore + buidlAmountToRedeem
. However, this check poses a significant risk as it could potentially cause the entire function to revert. While the third party contract that swaps BUIDL for USDC is unknown. It is highly improbable for any liquidity pool to maintain a precisely 1:1 ratio for USDC/BUIDL. Consequently, even a minor discrepancy, such as a difference of 1 wei in the swap amount, could lead to the failure of the function.Tools Used
Manual Review
Recommended Mitigation Steps
_redeemBUIDL()
should make sure balance after is equal or greater thanusdcBalanceBefore + buidlAmountToRedeem
Assessed type
DoS
The text was updated successfully, but these errors were encountered: