Ondo Finance - carrotsmuggler's results

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/ousgInstantManager.sol#L402-L405

Vulnerability details

Impact

The InstantManager contract restricts deposits and withdrawals to certain minimum amounts. Users can deposit a minimum of 100k USDC tokens, and withdraw a minimum of 50k USDC tokens.

The issue is that the minimum withdrawal limit can lead to users losing access to part of their funds. Say a user deposits 100k USDC tokens and then later withdraws 60k USDC tokens. Now, the user only has 40kUSDC worth holdings in their account, and cannot withdraw the full amount. This is because it falls below the minimum withdrawal limit of 50k USDC tokens. The user is now stuck with 40k USDC tokens in their account, and cannot withdraw them.

The only option the user has is to deposit 100k USDC more, and then withdraw the whole 140k USDC amount. This will incur fees on the extra 100k USDC the user brings as well. Thus this is a medium severity issue.

Proof of Concept

The scenario can be recreated in the following steps:

1. User ALICE deposits 100k USDC tokens.
2. User ALICE withdraws 60k USDC tokens.
3. User ALICE tries to withdraw 40k USDC tokens. The contract reverts, as the amount is below the minimum withdrawal limit of 50k USDC tokens.

Tools Used

Manual Review

Recommended Mitigation Steps

Allow users to remove all their funds from the contract even if it is below the minimum limit. Since the protocol now uses a more liquid system such as the BUIDL token, this should be possible and should not affect the protocol's functioning.

Assessed type

Other

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/ousgInstantManager.sol#L479-L48

Vulnerability details

Impact

The InstantManager contract has a hardcoded MINIMUM_OUSG_PRICE value of 105e18. The current price of OUSG tokens on coingecko is 105.63 USD, which is only 0.6% above the hardcoded value. The assumption is that the value of the token does not ever fall below 105 USD, below which the oracle is assumed to be misbehaving, and thus all operations are stopped.

function getOUSGPrice() public view returns (uint256 price) {
        (price,) = oracle.getPriceData();
        require(price > MINIMUM_OUSG_PRICE, "OUSGInstantManager::getOUSGPrice: Price unexpectedly low");
    }

The issue is that this is a very small margin of error. The funds in the contract will be deposited to the BUIDL fund. The contract already assumes that some USDC will remain unused in the contract, thus the APY realized by OUSG will be lower than the BUIDL fund.

Te BUIDL fund, according to the details available here, will invest 100% of its total assets in cash, U.S. Treasury bills, notes and other obligations issued or guaranteed as to principal and interest by the U.S. Treasury, and repurchase agreements secured by such obligations or cash. The Fund will invest, in both the primary and secondary markets, in U.S. Treasury bills, notes or other obligations that mature in three months or less from the settlement of the purchase.

While cash, notes and treasury bills are saef and can be assumed to never go down in value, repo (repurchase agreements) on secondary markets can have some level of risk associated with it, albeit very low. So there is a possibility that in the short term the fund can lose some value, enough to trigger the MINIMUM_OUSG_PRICE check on the protocol here built on top of it. This would then lead to a DOS of the protocol, since all price operations will stop.

Proof of Concept

Assume the blackrock fund loses 0.6% of its value due to some unforseen circumstances. That will be enough to trigger the MINIMUM_OUSG_PRICE check and stop all operations on the protocol. It is very unlikely that the fund will lose this value in the long term, however volatility in repo agreements in the short term are definitely possible.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider making the hardcoded value programmable. Or a lower more conservative limit like 104 USD would be more appropriate, which was the price of OUSG at the beginning of this year.

Assessed type

Other