The Standard

Summary

1. An asset price drops off-chain, but an oracle is not yet updated the price

   • An attacker can use block stuffing to further delay the update, or it's just a sudden price drop

   • The price drop must be more than collateralRate + mintFee - 100% , e.g. 11%

2. The attacker gets a flash-loan

3. Deposits

4. mint EUROs as much as they can

5. Sell all the minted EUROs

6. Returns flash-loan

Impact

The attacker made a profit and now the protocol has bad debt

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding a delay to allow mint only after X block after the deposit. Don't allow assets that are too volatile.