099.md

Glorious Garnet Tadpole

Medium

There is no slippage protection in the function unlockUsd0ppFloorPrice( contract Usd0PP).

Summary

before the user transaction(calling the function unlockUsd0ppFloorPrice), if the floor price for unlocking USD0++ to USD0 decreases , then the user will get less usd0 than expected which is unfair.

Root Cause

there is minamountout parameter in the function unlockUsd0ppFloorPrice.

Internal pre-conditions

before the user transaction(calling the function unlockUsd0ppFloorPrice), the floor price for unlocking USD0++ to USD0 should decrease.

External pre-conditions

No response

Attack Path

1. Let’s assume, currently the floor price for unlocking USD0++ to USD0 is 1e18.

2. Alice calls the function unlockUsd0ppFloorPrice with 100 usd0pp to get 100 USD0.

3. Before Alice's function unlockUsd0ppFloorPrice execution,the floor price for unlocking USD0++ to USD0 is updated to 0.9e18, as a result Alice gets 90 USD0 for 100 usd0pp which is unexpected/unfair for her.

function unlockUsd0ppFloorPrice(uint256 usd0ppAmount) external nonReentrant whenNotPaused { if (usd0ppAmount == 0) { revert AmountMustBeGreaterThanZero(); } if (balanceOf(msg.sender) < usd0ppAmount) { revert InsufficientUsd0ppBalance(); } Usd0PPStorageV0 storage $ = _usd0ppStorageV0();

    if ($.floorPrice == 0) {
        revert FloorPriceNotSet();
    }

    // as floorPrice can't be greater than 1e18, we will never have a usd0Amount greater than the usd0 backing
    uint256 usd0Amount = Math.mulDiv(usd0ppAmount, $.floorPrice, 1e18, Math.Rounding.Floor);

    _burn(msg.sender, usd0ppAmount);
    $.usd0.safeTransfer(msg.sender, usd0Amount);

    // Calculate and transfer the delta to the treasury
    uint256 delta = usd0ppAmount - usd0Amount;
    if (delta > 0) {
        address treasury = $.registryContract.getContract(CONTRACT_TREASURY);
        $.usd0.safeTransfer(treasury, delta);
    }

    emit Usd0ppUnlockedFloorPrice(msg.sender, usd0ppAmount, usd0Amount);
}

https://github.com/sherlock-audit/2024-10-usual-labs-v1/blob/main/pegasus/packages/solidity/src/token/Usd0PP.sol#L432

Impact

users can get less usd0 than expected.

PoC

No response

Mitigation

put minamountout parameter in the function unlockUsd0ppFloorPrice.