Summary

This report highlights a discrepancy in the handling of USD token issuance within the market's contract logic. When USD tokens are burned, the net issuance (netUsdTokenIssuance) is not updated accordingly, leading to a potential inconsistency in the system’s debt tracking.

Vulnerability Details

Observed Issue

In the current implementation when user swap usd for vault asset :

https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/market-making/branches/StabilityBranch.sol#L401

While the vault's marketsRealizedDebtUsd is updated when burning occurs, there is no corresponding update to netUsdTokenIssuance.

Market contract maintains a record of net USD token issuance, which is influenced by both minting and burning operations.

https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/market-making/leaves/Market.sol#L47

However, in the current implementation, only minting affects netUsdTokenIssuance, while burns do not reduce this value. This leads to an overestimated net issuance, potentially distorting debt calculations.

Impact

• Inconsistent Debt Representation: The vault's debt value reflects the burn, but the market still tracks an inflated netUsdTokenIssuance.

• Risk of Misreporting: Other system components that rely on netUsdTokenIssuance may make incorrect assumptions about the circulating supply.

• Debt Misalignment Across Markets: Since the vault interacts with multiple markets, a misalignment in issuance tracking can lead to incorrect debt adjustments across different markets.

Tools Used

• Manual Code Review to verify issuance and burning logic.

Recommendations

netUsdTokenIssuance should be update when burning usd