Lines of code
<https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L505&gt;

Vulnerability details

Impact

Hardcoded prices of stablecosins may open some arbitrage opportunities and produce many bad loans in CLM.

Proof of Concept

Hardcoding price of cUSDT and cUSDC as 1 may open some arbitrage opportunities when real price for each token is a little bit different, and user can borrow more than it actual amount in Canto Lending Market . Also, in case of UST-style collapse, there are exist many bad loans in CLM.

Tools Used

Webstorm

Recommended Mitigation Steps

Don’t hardcode cUSDT Price to 1.

The text was updated successfully, but these errors were encountered:

All reactions