Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

wrong bond value amount will result in loss of funds for users in ZENO during redemption

oldguard

Summary

during Bond redemption users are supposed to retrieve their face value or at least the startingPrice because it should be the closest to it albeit probably discounted but they are getting the usdc which is equal to the amount of bonds they minted not the price equivalent.

Vulnerability Details

When users redeem their bonds for the face Value at full maturity they are getting the bond amount in USDC instead of the face value i.e. if user's zeno balance = 5 they're getting 5 usdc, not even the amount they bought the bond for.

during minting they get the amount of zeno minted which is fine as long as when redemption time comes there's a mechanism in place for determining the correct amount of USDC they're supposed to get but there isn't as shown below :

function redeem(uint amount) external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
​
if (amount == 0) {
revert ZeroAmount();
}
​
uint256 totalAmount = balanceOf(msg.sender);
if (amount > totalAmount) {
revert InsufficientBalance();
}
​
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount);// wrong should be face value of bond if bond is at full maturity

Impact

  • This will result in loss of funds for users as they're not even getting the cost of the bond back resulting in utter dissatisfaction in the system

Tools Used

Recommendations

  • if the starting price is equal to the face value of the bond then consider transferring the face value in usdc back to all users during redemption if bond is at full maturity which it will be because users will generally not redeem until it is

  • consider implementing a mechanism similar to the getPrice mechanism for price determination in Auction.sol which would determine price based on how closer we are to full maturity and ensure user get at least the amount they paid for the bonds

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

ZENO.sol implements fixed 1:1 redemption with USDC regardless of auction purchase price, breaking zero-coupon bond economics and causing user funds to be permanently lost

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.