Ondo Finance - 0xGreyWolf's results

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/ousgInstantManager.sol#L254-L276

Vulnerability details

Impact

The function mintRebasingOUSG() invokes an internal function _mint() which returns ousgAmountOut which then is converted to rousgAmountOut and transferred to the msg.sender in exchange of usdcAmountIn. Since there is an exchange / conversion of assets, users must be protected from slippage.

• mintRebasingOUSG()

  function mintRebasingOUSG(
      uint256 usdcAmountIn
  )
      external
      override
      nonReentrant
      whenMintNotPaused
      returns (uint256 rousgAmountOut)
  {
      uint256 ousgAmountOut = _mint(usdcAmountIn, address(this));
      ousg.approve(address(rousg), ousgAmountOut);
      rousg.wrap(ousgAmountOut);
      rousgAmountOut = rousg.getROUSGByShares(
      ousgAmountOut * OUSG_TO_ROUSG_SHARES_MULTIPLIER
      ); // @audit there should be slippage protection after this line
      rousg.transfer(msg.sender, rousgAmountOut); 
      emit InstantMintRebasingOUSG(
      msg.sender,
      usdcAmountIn,
      ousgAmountOut,
      rousgAmountOut
      );
  }

It is important to note that the minimum deposit amount is 100_000 USDC. Hence, recurring slippages of small percentages is a huge issue.

• OUSGInstantManager @ line 106

  // Minimum amount of USDC that must be deposited to mint OUSG or rOUSG
  // Denoted in 6 decimals for USDC
  uint256 public minimumDepositAmount = 100_000e6;

Proof of Concept

Tools Used

Manual Review

Recommended Mitigation Steps

Parameterize rousgAmountOutMin and if rousg.getROUSGByShares() returns rousgAmountOut that is lower than rousgAmountOutMin, the function should revert.

function mintRebasingOUSG(
    uint256 usdcAmountIn,
++  uint256 rousgAmountOutMin
)
    external
    override
    nonReentrant
    whenMintNotPaused
    returns (uint256 rousgAmountOut)
{
    uint256 ousgAmountOut = _mint(usdcAmountIn, address(this));
    ousg.approve(address(rousg), ousgAmountOut);
    rousg.wrap(ousgAmountOut);
    rousgAmountOut = rousg.getROUSGByShares(
    ousgAmountOut * OUSG_TO_ROUSG_SHARES_MULTIPLIER
    );
++  if (rousgAmountOut < rousgAmountOutMin) revert SlippageProtection();    
    
    rousg.transfer(msg.sender, rousgAmountOut); 
    emit InstantMintRebasingOUSG(
    msg.sender,
    usdcAmountIn,
    ousgAmountOut,
    rousgAmountOut
    );
}

Also, there should be a calculation preview of what amount of rousgAmountOut to expect so that the user can input the acceptable rousgAmountOutMin value.

Assessed type

Other