002.md

Main Punch Caterpillar

Medium

Minter Exchanges For Underlying At A Constant Rate

Summary

The Minter exchanges boostAddress for collateralAddress at a constant rate, which results in vulnerable trades.

Root Cause

When minting IBoostStablecoin, the Minter attempts to treat the underlying collateral asset as redeemable for IBoostStablecoin at a one-to-one-rate.

For simplicity, let's assume that boostAddress and collateralAddress both 18 decimals of precision:

function mint(address to, uint256 amount) external whenNotPaused onlyContract onlyRole(MINTER_ROLE) {
    IERC20Upgradeable(collateralAddress).safeTransferFrom(
        msg.sender,
        treasury,
-       amount / (10 ** (boostDecimals - collateralDecimals))
+       amount
    );
    IBoostStablecoin(boostAddress).mint(to, amount);
    emit TokenMinted(msg.sender, to, amount);
}

https://github.com/sherlock-audit/2024-10-axion/blob/3704f19ea52ebe255861ded3da0d3648c764fb69/liquidity-amo/contracts/Minter.sol#L77C14-L77C46

It is clear that the Minter will attempt to mint at a constant rate for the underlying collateral, irrespective of the economic reality.

Internal pre-conditions

No response

External pre-conditions

1. The price of collateral is trading at $1.00 and the price of boost is trading at $0.99.

Attack Path

1. An authorized minter exchanges 100,000 of underlying in exchange for 100,000 boost.

In real terms, the minter has exchanged $100,000 of assets in exchange for $99,000 of boost (1% loss).

Impact

The Minter does not respect the price volatility of the underlying stablecoin, resulting in unfair trades.

PoC

No response

Mitigation

Use a price oracle.