A WHALE CAN DoS A NORMAL USER FROM MINTING AND REDEEMING THE USDe BY MAKING THE MINT AMOUNT AND REDEEM AMOUNT PER BLOCK, EXCEEDING THE maxMintPerBlock AND maxRedeemPerBlock RESPECTIVELY

Lines of code Vulnerability details Impact The EthenaMinting.mint function and EthenaMinting.redeem function both have defined modifiers belowMaxMintPerBlock and belowMaxRedeemPerBlock to ensure the mint amount per block and redeem amount per block are limited to upper bounds set by the...

Wrong errors degradate UX

Lines of code Vulnerability details Impact If the beneficiary of the order is address0, it will revert popping up the error InvalidAmount. This is bad as the UI will show the users they put wrong either the collateral amount or the USDe amount, when those values may be correct. Proof of Concept...

precision issue EthenaMinting:mint() allows users to steal fund.

Lines of code Vulnerability details Impact In the EthenaMinting:mint function of the contract, a call is made to the transferCollateral function. This function calculates the transfer amount using the formula uint256 amountToTransfer = amount ratiosi / 10000;. However, it does not account for...

The _transferToBeneficiary() incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1.

Lines of code Vulnerability details Impact The transferToBeneficiary function of EthenaMinting.sol incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1. Proof of Concept The transferToBeneficiary function is used in redeem function of EthenaMinting.sol. Though, you are not allowed ...

bad Actor can block the operation of mint by creating duplicate order by frunt runing original order

Lines of code Vulnerability details Impact bad Actor can block the operation of mint by creating duplicate order by frunt runing original order So basically the contracts are doing orders by users RFQ to system whether by API or front end. and make the mint process the problem is in the contract...

EthenaMinting.sol#_setMaxRedeemPerBlock() - Function doesn't enforce any constraints

Lines of code Vulnerability details Explanation The EthenaMinting.solsetMaxMintPerBlock function is responsible for setting the maximum limit for minting USDe tokens in a single block. function setMaxMintPerBlockuint256 maxMintPerBlock external onlyRoleDEFAULTADMINROLE...

Temporary DOS attack on all the users minting and redeeming.

Lines of code Vulnerability details Impact The users redeeming and minting using EthenaMinting.sol can be DOS'd temporarily for some blocks by an old user having many tokens staked. Proof of Concept The old user having a high staked amount can easily get the order to redeem and mint with the USDe...