hack3r-0m - Mispricing in issue and redeem during ongoing rebalance

[sherlock-admin2]

hack3r-0m

Medium

Mispricing in issue and redeem during ongoing rebalance

Summary

• https://github.com/sherlock-audit/2024-10-morpho-x-index/blob/main/index-coop-smart-contracts/contracts/adapters/MorphoLeverageStrategyExtension.sol#L358

when doing iterateRebalance, it can last over long period of time where instantaneous leverage is out of bounds of expected leverage.

When user mints or redeems set token, they are either paying and premium or receiving a discount due to position not being in ideal state and hence not accounting for cost to reach there (slippage, lever/delever fees, etc.)

Root Cause

• issue and burn are allowed during iterateRebalance

Internal pre-conditions

• IterateRebalance is ongoing when user is minting or redeeming

External pre-conditions

• N/A

Attack Path

• iterateRebalance followed by burn or mint

Impact

• A user might be able to redeem at a premium price on set token temporarily
• A user might be able to mint set token at discount temporarily

PoC

N/A

Mitigation

• lock and unlock in setToken when iterate rebalance is in progress
• any other mechanism which prevents minting from debt issuance module when rebalance is in progress