Ondo Finance - nonn_ac's results

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/be2e9ebca6fca460c5b0253970ab280701a15ca1/contracts/ousg/ousgInstantManager.sol#L290 https://github.com/code-423n4/2024-03-ondo-finance/blob/be2e9ebca6fca460c5b0253970ab280701a15ca1/contracts/InstantMintTimeBasedRateLimiter.sol#L108

Vulnerability details

Impact

The purpose of currentInstantMintAmoun is to track the value of ousg, which represents the tokens minted over a set duration of time, However the current implementation updates currentInstantMintAmount using usdcAmountIn, which is the initial USDC amount received. Later, a fee percentage will be deducted from this amount. Unfortunately, this approach leads to a significant inflation of currentInstantMintAmount, surpassing the actual quantity of minted tokens. Since a portion of the USDC will be deducted as fees, currentInstantMintAmount increases rapidly, potentially reaching the instantMintLimit prematurely.

For instance, consider a scenario where the protocol imposes a 5 USDC mint fee. If a user mints with 100 USDC, the function _checkAndUpdateInstantMintLimit updates currentInstantMintAmount by adding the full 100 USDC to its value. Consequently, the calculated mint amount will be 100 - 5 = 95 USDC. The issue lies in _checkAndUpdateInstantMintLimit updating currentInstantMintAmount with the entire usdcAmount of 100, rather than using the minted ousgAmountOut value of 95.

Proof of Concept

https://github.com/code-423n4/2024-03-ondo-finance/blob/be2e9ebca6fca460c5b0253970ab280701a15ca1/contracts/ousg/ousgInstantManager.sol#L278-L324

https://github.com/code-423n4/2024-03-ondo-finance/blob/be2e9ebca6fca460c5b0253970ab280701a15ca1/contracts/InstantMintTimeBasedRateLimiter.sol#L93-L109

Tools Used

Manual

Recommended Mitigation Steps

currentInstantMintAmount should be updated with mint ousgAmountOut rather than the usdcAmountIn since the fee will later be deducted.

Assessed type

Other