Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing price implementation causes the users redeem less USDC

pabloperezacc6

Summary

Users can buy the ZENO token through the Auction using USDC, and they can redeem it after a specified maturity period. The cost of buying ZENO tokens is calculated as cost = price * amount, but during redemption, users only receive an amount of USDC equivalent to the number of ZENO tokens they hold. This discrepancy leads to a potential loss of funds for users.

Vulnerability Details

When a user attempts to buy ZENO, they invoke the Auction.buy() function. The function calculates the necessary USDC payment based on the current price and the amount of tokens being purchased.

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
@> uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}

Upon maturity, users can redeem their ZENO tokens by calling the ZENO.redeem() function. However, the current implementation only returns USDC equal to the number of ZENO tokens held, leading to loss of funds.

function redeem(uint amount) external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
​
if (amount == 0) {
revert ZeroAmount();
}
​
uint256 totalAmount = balanceOf(msg.sender);
if (amount > totalAmount) {
revert InsufficientBalance();
}
​
totalZENORedeemed += amount;
_burn(msg.sender, amount);
@> USDC.safeTransfer(msg.sender, amount);
}

Impact

Users holding ZENO tokens will incur financial losses during the redemption process.

Tools Used

Manual Review

Recommendations

Implement price calculation to the ZENO.redeem() function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

ZENO.sol implements fixed 1:1 redemption with USDC regardless of auction purchase price, breaking zero-coupon bond economics and causing user funds to be permanently lost

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.