Submission Details
Severity:
[H-2] Incorrect Debt Accounting Allows Premium/Discount Exploitation at `StabilityBranch`
Summary
The getAmountOfAssetOut function uses unvalidated debt values to compute premiums/discounts, enabling artificial inflation of asset outputs.
Vulnerability Details
Affected Code:
// StabilityBranch.sol
SD59x18 vaultDebtUsdX18 = vault.getTotalDebt();
UD60x18 premiumDiscountFactorX18 = ... // Depends on debt
Exploit Scenario:
-
Attacker opens positions to artificially inflate vault debt.
-
Triggers swaps during high debt to get inflated asset outputs.
-
Profit from arbitrage between real and protocol prices.
Impact
Protocol Insolvency: Vault assets depleted via inflated swaps.
Severity: High (CVSS 8.7).
Tools Used
Debt simulation scripts.
Differential price analysis.
Recommendations
// Add debt sanity bounds
require(vaultDebtUsdX18.abs() < MAX_DEBT, "Debt exceeds safe limit");
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.