Astrotimi - Incorrect Assumption of Stablecoin Market Stability

[sherlock-admin2]

Astrotimi

Medium

Incorrect Assumption of Stablecoin Market Stability

SUMMARY

The arbitrage can be observed by assessing the difference in the trade outputs and can be capitalized by selling our newly acquired USDT for USDC on the stablecoin pair we assessed , ultimately ending up with a greater amount of USDC than we started with. This type of attack can be extrapolated by utilizing a flash-loan rather than our personal funds.

LINE OF CODE

https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/stablecoin/Stablecoin.sol#L149

IMPACT

The Stablecoin contract attempts to group all types of stablecoins under a single token which can be minted for any of the stablecoins supported by the system as well as burned for any of them.

This is at minimum a medium-severity vulnerability as the balance sheet of the Stablecoin will consist of multiple assets which do not have a one-to-one exchange ratio between them as can be observed by trading pools such as [Curve](https://curve.fi/#/ethereum/pools/3pool/deposit) as well as the [Chainlink oracle reported prices themselves](https://data.chain.link/ethereum/mainnet/stablecoins/usdc-usd).

Given that the contract exposes a 0% slippage 1-to-1 exchange between assets that in reality have varying prices, the balance sheet of the contract can be arbitraged (especially by flash-loans) to swap an undesirable asset (i.e. USDC which at the time of submission was valued at 0.99994853 USD) for a more desirable asset (i.e. USDT which at the time of submission was valued at 1.00000000 USD) acquiring an arbitrage in the price by selling the traded asset.

Tools Used

[Chainlink oracle resources](https://data.chain.link/popular)

[Curve Finance pools](https://curve.fi/#/ethereum/pools)

Recommended Mitigation Steps

1. We advise the Stablecoin to utilize Chainlink oracles for evaluating the inflow of assets instead, ensuring that all inflows and outflows of stablecoins are fairly evaluated based on their "neutral" USD price rather than their subjective on-chain price or equality assumption.

2. Keep the protocol with one token for now