search

sherlock-audit / 2023-04-unitasprotocol-judging

4 stars 3 forks source link

stopthecap - Minting stables such as USD91 using USD1 with Reserve ratio ≤ 130% will fail #65

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

stopthecap

high

Minting stables such as USD91 using USD1 with Reserve ratio ≤ 130% will fail

Summary

Minting stables such as USD91 using USD1 with Reserve ratio ≤ 130% will fail

Vulnerability Detail

When Reserve ratio ≤ 130% there are different instructions that hold for that specific reserve ratio: 

Pause USD1 minting temporarily
Allow minting of USD91 and USD971, USD971, USD886 & USD84
wait for reserve ratio to go above >130% to restart minting USD1 from USDT
allow exit of USD91,USD971, USD886 & USD84 to USD1
allow exit of USD1 to USDT

In the following case:
https://github.com/sherlock-audit/2023-04-unitasprotocol-0xffff11/tree/main/Unitas-Protocol#minting-usd91-and-other-emcs-using-usd1

minting of USD91 and other EMCS must be allowed if reserve ratio is ≤ 130%.

Codes fails to deliver and does not allow to mint other EMCS with USD1 because as you can see on the code:

https://github.com/sherlock-audit/2023-04-unitasprotocol/blob/main/Unitas-Protocol/src/Unitas.sol#L228-L232

When this scenario happens the token used to charge fees is usd1, the base token. However, as the protocol says, usd1 minting will be paused if ratio is <= 130%. Meaning that any minting of EMCS using usd1 will fail

Impact

Unable to buy EMCs with usd1, breaking crucial invariant

Code Snippet

https://github.com/sherlock-audit/2023-04-unitasprotocol/blob/main/Unitas-Protocol/src/Unitas.sol#L228-L232

Tool used

Manual Review

Recommendation

Change the feeToken to the EMC minted at the moment of reserve ratio <=130%