Ondo Finance - Honour's results

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/ousgInstantManager.sol#L230-L232 https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/ousgInstantManager.sol#L335-L337

Vulnerability details

Impact

Possible loss of funds for kyc'd investors due to price changes in OUSG impact- High, likelihood- Medium

Proof of Concept

OUSGInstantManager mint/redeem doesn't include slippage checks which means users can end up minting/redeeming OUSG/rOUSG at a worse price than expected. Considering the initial minDepositAmount 100,000usdc and minRedemptionAmount 50,000usdc as baselines https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/ousgInstantManager.sol#L106 https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/ousgInstantManager.sol#L110 OUSG price changes of 0.1%-1% would be equivalent to a loss of 100-1,000usdc on mint & 50-500usdc on redeem

Tools Used

Manual Review

Recommended Mitigation Steps

Users should be able to specify a min amount of ousg on mint or usdc on redeem

function mint(
    uint256 usdcAmountIn,
    uint256 minOusgAmountOut
  ) returns (uint256 ousgAmountOut) {
//...code...
  require(ousgAmountOut >= minOusgAmountOut);
}

  function redeem(
    uint256 ousgAmountIn,
    uint256 minUsdcAmountOut
  ) returns (uint256 usdcAmountOut){
//code...
require(usdcAmountOut >= minUsdcAmountOut);
}

Assessed type

Other