USDV.sol Mint and Burn Amounts Are Incorrect

Handle leastwood Vulnerability details Impact The USDV.mint function queries the price of Vader from the LiquidityBasedTwap contract. The calculation to determine uAmount in mint is actually performed incorrectly. uAmount = vPrice vAmount / 1e18; will return the USD amount for the provided Vader ...

Slippage control

Handle pauliax Vulnerability details Impact functions mint and burn of USDV should allow the user to specify min amounts to receive. This would help the user to avoid a huge slippage. Another reason is that price is fetched from lbt but this address can be changed anytime function setLBTwap, so i...

USDV TWAP averages wrong

Handle cmichel Vulnerability details The vader price in LiquidityBasedTWAP.getUSDVPrice is computed using the pastLiquidityWeights and pastTotalLiquidityWeight return values of the syncUSDVPrice. The syncUSDVPrice function does not initialize all weights and the total liquidity weight does not...

previousPrices Is Never Updated Upon Syncing Token Price

Handle leastwood Vulnerability details Impact The LiquidityBasedTWAP contract attempts to accurately track the price of VADER and USDV while still being resistant to flash loan manipulation and short-term volatility. The previousPrices array is meant to track the last queried price for the two...

Insufficient access control on VaderPoolV2.mintSynth allows theft of user funds

Handle TomFrenchBlockchain Vulnerability details Impact Loss of all USDV approved onto VaderPoolV2. Proof of Concept VaderPoolV2 allows minting of synth tokens with the mintSynth function This allows anyone to take USDV from the from address and mint synths to be sent to the to address. There is ...

Reserve does not properly apply prices of VADER and USDV tokens

Handle TomFrenchBlockchain Vulnerability details Impact Reserve pays out vastly higher or lower IL protection than it should Proof of Concept Consider the lines 98 and 102 as shown on the link below: Here we multiply the IL experienced by the LP by a price for USDV or VADER as returned by the LBT...

Oracle returns an improperly scaled USDV/VADER price

Handle TomFrenchBlockchain Vulnerability details Impact Invalid values returned from oracle in vast majority of situations Proof of Concept The LBT oracle does not properly scale values when calculating prices for VADER or USDV. To show this we consider the simplest case where we expect USDV to...

Oracle doesn't calculate USDV/VADER price correctly

Handle TomFrenchBlockchain Vulnerability details Impact Invalid values returned from oracle for USDV and VADER prices in situations where the oracle uses more than one foreign asset. Proof of Concept The USDV price is calculated as so for simplicity we'll consider a two pairs: totalUSD =...

USDV uses incorrect exchange rate for burning

Handle TomFrenchBlockchain Vulnerability details Impact A money pump exists whenever VADER is worth more than $1. Proof of Concept When minting USDV, the amount minted is uAmount = vPrice vAmount / 1e18 where vPrice is the price of VADER in terms of USD. When burning USDV, the amount of VADER...

VaderReserve.reimburseImpermanentLoss improperly converts USDV to VADER

Handle TomFrenchBlockchain Vulnerability details Impact IL isn't properly converted from being in terms of USDV to VADER, resulting in reserve paying out incorrect amount. Proof of Concept VaderReserve.reimburseImpermanentLoss receives an amount in terms of USDV and converts this to an amount of...

Should a Chainlink aggregator become stuck in a stale state then TwapOracle will become irrecoverably broken

Handle TomFrench Vulnerability details Impact Inability to call consult on the TwapOracle and so calculate the exchange rate between USDV and VADER. Proof of Concept Should any of the Chainlink aggregators used by the TwapOracle becomes stuck in such a state that the check on L143-146 of...

deploySynth does not prevent token to be VADER or USDV

Handle paulius.eth Vulnerability details Impact function deploySynth checks that token is not VADER or not USDV. The condition should be && not || as OR condition always holds when VADER != USDV: function deploySynthaddress token external requiretoken != VADER || token != USDV;...

USDV functions can be called before initialization in init() of USDV.sol

Handle 0xRajeev Vulnerability details Impact All the external/public functions of USDV.sol can be called by other contracts even before USDV.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...