sherlock-audit / 2023-05-USSD-judging

9 stars 7 forks source link

simon135 - DAI can be overshoot causing a USSD depegg #967

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

simon135

medium

DAI can be overshoot causing a USSD depegg

Summary

since

if (collateral[i].token != uniPool.token0() || collateral[i].token != uniPool.token1())

and since it's not && token0 can be USSD and collateral[0] be Dai and we can buy more Dai with dai which it says in the protocol comments that it should not be allowed to happen


the comments 
// don't touch DAI if it's needed to be bought (it's already bought)

## Vulnerability Detail
We can cause overShoot of dai which will cause depend possibly wich should not happen
## Impact
depeeg and code error
## Code Snippet

## Tool used

Manual Review

## Recommendation
make it && instead

Duplicate of #193