Submission Details
Severity:
When redeeming ZENO, assuming a 1:1 ratio with USDC, there is an arbitrage opportunity.
Summary
When redeeming ZENO, assuming a 1:1 ratio with USDC, there is an arbitrage opportunity.
Vulnerability Details
getPrice() gradually decreases the price from startingPrice to reservePrice.
If reservePrice is set below 1 USDC, ZENO can be purchased at a low price in the later stages of the auction.
function getPrice() public view returns (uint256) {
if (block.timestamp < state.startTime) return state.startingPrice;
if (block.timestamp >= state.endTime) return state.reservePrice;
return state.startingPrice - (
(state.startingPrice - state.reservePrice) *
(block.timestamp - state.startTime) /
(state.endTime - state.startTime)
);
}
After expiration, ZENO can be redeemed 1:1 for USDC, regardless of its initial purchase price.
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount);
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.