Core Contracts

Vulnerability Details

As per the raac docs, zeno token is like a zero coupon bond meaning you buy it at a discounted price and redeem it at face value. In the code implementation we are paying more for getting zeno token and getting less at maturity.

Impact

Inside Auction::buy we are specifying the amount of zeno tokens we want to buy, now this is multiplied by the price to calculate the actual cost that buyer has to pay.
The amount of usdc that the user will get at maturity when he calls ZENO::redeem will be equivalent to his zeno balance, it will not account for the price he paid during buying them.

Tools Used

Manual Review

Recommendations

Inside Auction::buy, zeno tokens should be minted at a price lesser than the face value. This difference between the face value and issue value will be return for minter.