Ethena Labs - PENGUN's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDeV2.sol#L116

Vulnerability details

Impact

USDe cannot be used in defi. This affects the usability of USDe and prevents it from bringing in more users.

Proof of Concept

To stake and unstake USDe, user need to wait for the cooldown period. User can send an unstake request through the cooldownShares function, where cooldownEnd is dependent on owner.

  function cooldownShares(uint256 shares, address owner) external ensureCooldownOn returns (uint256) {
    if (shares > maxRedeem(owner)) revert ExcessiveRedeemAmount();

    uint256 assets = previewRedeem(shares);

    cooldowns[owner].cooldownEnd = uint104(block.timestamp) + cooldownDuration;
    cooldowns[owner].underlyingAmount += assets;

    _withdraw(_msgSender(), address(silo), owner, assets, shares);

    return assets;
  }

Assuming a cooldownDuration of 14 days, if user A requests 1000 USDe to unstake, and then 10 days later requests 500 USDe again, they will have to wait 14 days from the second request. This is not good from a UX perspective and prevents the creation of defi utilizing USDe.

Tools Used

VS Code

Recommended Mitigation Steps

Manage the underlyingAmount by withdraw, not by owner.

Assessed type

Other