Ondo Finance - 0xweb3boy's results

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/ousgInstantManager.sol#L307 https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/ousgInstantManager.sol#L399 https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/ousgInstantManager.sol#L479-L485

Vulnerability details

Impact

The mint and redeem function will revert in an edge case.

Proof of Concept

The _mint and the redeem function are internally calling the getOUSGPrice() function to retrieve the price of the OUSG and further mint the and redeem accordingly however getOUSGPrice() function is a view function used to get the price of OUSG from the oracle. There is a require condition which checks if price > MINIMUM_OUSG_PRICE and reverts accordingly.

function getOUSGPrice() public view returns (uint256 price) {
    (price, ) = oracle.getPriceData();
    require(
      price > MINIMUM_OUSG_PRICE,
      "OUSGInstantManager::getOUSGPrice: Price unexpectedly low"
    );
  }

The problem is getOUSGPrice() function isn't handling the case when price = MINIMUM_OUSG_PRICE and will revert in that case which is not ideal case. It should only revert in case of price < MINIMUM_OUSG_PRICE.

Tools Used

Manual review

Recommended Mitigation Steps

Just replace

function getOUSGPrice() public view returns (uint256 price) {
    (price, ) = oracle.getPriceData();
    require(
-      price > MINIMUM_OUSG_PRICE,
+      price >= MINIMUM_OUSG_PRICE,
      "OUSGInstantManager::getOUSGPrice: Price unexpectedly low"
    );
  }

Assessed type

DoS