Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

ZENO Contract - Missing USDC Reserve Checks

destiny

Summary

The ZENO contract allows the owner to mint tokens without ensuring the protocol holds sufficient USDC reserves to back them. This leads to undercollateralization, where the total ZENO supply exceeds the USDC reserves. Users redeeming ZENO tokens may receive no USDC, resulting in permanent fund loss.

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/zeno/ZENO.sol#L34

Vulnerability Details

Example Scenario

  • Mint ZENO Without Reserves:

The owner mints 1,000,000 ZENO without depositing any USDC into the contract.

  • Users Attempt Redemption:

Users redeem ZENO after the maturity date, but the contract lacks USDC to fulfill withdrawals.

Code Proof

In ZENO.sol, the mint function lacks USDC reserve checks:

function mint(address to, uint256 amount) external onlyOwner {
if (amount == 0) { revert ZeroAmount(); }
_mint(to, amount); // No USDC reserve validation
totalZENOMinted += amount;
}

Attack Simulation

Mint 1M ZENO Without Reserves:

ZENO.mint(attacker, 1_000_000e18); // Mints tokens with 0 USDC balance

User Redeems Tokens:

ZENO.redeem(1_000_000e18); // Fails: USDC balance = 0

Result: Users cannot redeem ZENO tokens, rendering them worthless.

Impact

Protocol Insolvency: ZENO tokens become unbacked "IOUs" (I Owe You) with no real value.

User Fund Loss: Redeeming users receive nothing despite holding ZENO tokens.

Tools Used

Static analysis, manual review

Recommendations

Add Reserve Check to Minting
- Modify the mint function to ensure the contract holds sufficient USDC reserves:

function mint(address to, uint256 amount) external onlyOwner {
if (amount == 0) { revert ZeroAmount(); }
require(
USDC.balanceOf(address(this)) >= totalSupply() + amount, // Reserve check
"Insufficient USDC reserves"
);
_mint(to, amount);
totalZENOMinted += amount;
}

Why This Fix Works
- The mint function now verifies that the contract’s USDC balance covers the new total ZENO supply (existing + minted tokens).

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.