search

sherlock-audit / 2023-01-derby-judging

4 stars 1 forks source link

tives - Vault.rebalance assumes stablecoin price parity and will revert if it cannot make the swap, locking user funds. #335

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

tives

medium

Vault.rebalance assumes stablecoin price parity and will revert if it cannot make the swap, locking user funds.

Summary

Vault.rebalance assumes stablecoin price parity and makes a swap according to this when rebalancing.

Vulnerability Detail

During a turbulent market or stablecoin bankrun, the USDC/(USDT/DAI) price can deviate from 1:1. Vault.rebalance calls

These functions swap stable tokens on Curve. The amountOutMin is calculated with the assumption of 1:1 price, excluding pool fee.

uint256 amountOutMin = (((_swap.amount * (10000 - _curve.poolFee)) / 10000) * _tokenOutUScale) / _tokenInUScale;

Now, when USDT/USDC price is 0.9, the protocol tries to swap 1USDC for 1USDT. But that swap fails because prices have deviated. Now the vault is locked because rebalance flow cannot complete.

Impact

User cannot call withdraw, withdrawRewards, withdrawAllowance. These functions require the vault to be in idle state.

Code Snippet

uint256 amountOutMin = (((_swap.amount * (10000 - _curve.poolFee)) / 10000) * _tokenOutUScale) / _tokenInUScale;

[link](https://github.com/sherlock-audit/2023-01-derby/blob/main/derby-yield-optimiser/contracts/libraries/Swap.sol/#L42)

Tool used

Manual Review

Recommendation

Use price oracles to verify pair’s 1:1 price. Input expected price on rebalance function.

Duplicate of #135