USDMPegRecovery Will Most Certainly Lead To Failed Withdrawals When All Supplied Liquidity Is Removed

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-concur/blob/main/contracts/USDMPegRecovery.sol

Vulnerability details

Impact

The USDMPegRecovery contract intends to bootstrap the usdm3crv Curve liquidity pool such that USDM can recover its peg. Users are allowed to deposit and withdraw their usdm and pool3 tokens to contribute to the peg recovery process. Upon depositing, the contract will update the user's usdm and pool3 token balance and the contract's total liquidity.

Guardians can then use deposited tokens to provide liquidity in multiples of the configured step amount which equates to 250000e18 tokens. However, the contract fails to consider two important things:

• Fees are charged upon adding/removing liquidity.
• The liquidity pool does not constitute an equal number of usdm/pool3 tokens.

As a result, it is almost impossible for users to withdraw all deposited tokens once all liquidity has been removed from the Curve pool. If there are more usdm tokens (after LP withdrawal) as compared to total.pool3, then some users will not be able to retrieve their initial pool3 token deposit.

Proof of Concept

https://github.com/code-423n4/2022-02-concur/blob/main/contracts/USDMPegRecovery.sol

Tools Used

Manual code review.

Recommended Mitigation Steps

Consider accounting for the incorrect assumption that once all liquidity is removed, the contract will receive usdm and pool3 tokens equal to or greater than total.usdm and total.pool3 respectively.

[GalloDaSballo]

Duplicate of #70