Skip to content

Latest commit

 

History

History
63 lines (38 loc) · 2.55 KB

044.md

File metadata and controls

63 lines (38 loc) · 2.55 KB
Raw

Proud Punch Mouse

Medium

Usd0PP token holders did not receive any interest earnings.

Summary

Usd0PP token holders did not receive any interest earnings.

Root Cause

According to the documentation: https://usual.gitbook.io/usual-technical-documentation/Aw3jUdIChYIRnEPcqUqK/overview/features/usd0++

It offers daily yield distribution in $USUAL tokens, with a variable rate based on market price, and guarantees a floor yield in USD0, matching the risk-free yield. However, in the code: https://github.com/sherlock-audit/2024-10-usual-labs-v1/blob/4fb4a64a479e0b9b8f93934220e891c29d54df33/pegasus/packages/solidity/src/token/Usd0PP.sol#L244

    function unwrap() external nonReentrant whenNotPaused {
        Usd0PPStorageV0 storage $ = _usd0ppStorageV0();

        // revert if the bond period is not finished
        if (block.timestamp < $.bondStart + BOND_DURATION_FOUR_YEAR) {
            revert BondNotFinished();
        }
        uint256 usd0PPBalance = balanceOf(msg.sender);

@>        _burn(msg.sender, usd0PPBalance);

@>        $.usd0.safeTransfer(msg.sender, usd0PPBalance);

        emit BondUnwrapped(msg.sender, usd0PPBalance);
    }

We can see that Usd0PP is only exchanged back to usd0 at a 1:1 ratio. Usd0PP holders do not receive any yield earnings—there is no $USUAL yield reward nor a floor yield in USD0. The Usd0PP contract also does not implement any functions related to yield rewards.

As the bonds mature, the value of the US Treasury Bill tokens (USYC) gradually increases. The value stored in the treasury exceeds the total amount of usd0 and will further increase over time, adding more value to the treasury. In theory, the treasury’s earnings (interest income from bonds) could be used to mint additional usd0 and distribute it to Usd0PP holders, thereby guaranteeing a floor yield in USD0 that matches the risk-free yield. However, this feature is not currently implemented in the code.

Even though users who initially converted usd0 to usd0PP might receive $USUAL airdrop rewards, this is not considered yield rewards. Additionally, users who convert usd0 to usd0PP later do not receive any rewards at all.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

The documentation mentions that yield rewards are not allocated to Usd0PP token holders; the treasury retains all bond earnings without distributing them to anyone. This could lead to users losing trust in the protocol.

PoC

No response

Mitigation

Implement yield earnings for Usd0PP.