Protocol insolvency and the user's inability to redeem their tokens

Summary

In the event of a depeg of any of the collateral tokens, a situation may arise where the total value of the entire collateral, divided by the number of Ubiquity Dollar tokens, is less than 1. The redeem function operates under the assumption that the price of one Ubiquity Dollar token is $1. Therefore, if many users start exchanging their tokens for collateral, this may not be possible for some of them because there would be no available collateral at some point.

Vulnerability Detail

The only safeguard mechanism available to the protocol in the event of such an occurrence is the pausing of certain functionalities. However, this involves human interaction, and it is unclear whether the protocol administrators will react quickly enough to prevent the described scenario. No off-chain mechanisms monitoring such a situation are described in the README file.

Impact

Possible protocol insolvency - a state in which there are circulating Ubiquity Dollar tokens, but there is no collateral to back them up. I would like to note that a depeg of a stablecoin, whether brief or not so brief, is not something extremely unusual and occurs relatively often.

Code Snippet

https://github.com/sherlock-audit/2023-12-ubiquity/blob/d9c39e8dfd5601e7e8db2e4b3390e7d8dff42a8e/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol#L399-L465

Tool used

Manual Review

Recommendation

An possible solution is to add additional checks for the lower bound of the price of collateral tokens during the redeem process.

Duplicate of #17

sherlock-admin2 commented 6 months ago

1 comment(s) were left on this issue during the judging contest.

auditsea commented:

The issue describes about the protocol insolvancy in case of collateral depeg. It's not avoidable, that's why the protocol has borrowing function to get yield, take fees on mint and redeem, these features will hedge the risk from protocol insolvancy