091.md

kiki_dev

medium

Users can mint 0 USSD in excange for non-zero amount

Summary

```Users can mint 0 USSD for non zero amount resulting in both users loosing funds and needlessly putting pressure on the rebalance() function by recieving token without minting appropriate amount of USSD

Vulnerability Detail

In calculateMint() calculations are performed to determine how much USSD a user should get in exchange for the amount they put in. /// @dev Return how much STABLECOIN does user receive for AMOUNT of asset function calculateMint(address _token, uint256 _amount) public view returns (uint256 stableCoinAmount) { uint256 assetPrice = collateral[getCollateralIndex(_token)].oracle.getPriceUSD(); return (((assetPrice * _amount) / 1e18) * (10 ** decimals())) / (10 ** IERC20MetadataUpgradeable(_token).decimals()); }

The issue here is that there is no check for zero on the value being returned. In some instances it is possible for a user to deposit a real amount of tokens and get 0 USSD in return

Below you

    function calculateMint(uint256 _amount /*this would go where the 1e8 is*/) public view returns (uint256) {
        uint256 assetPrice = 4000e18; // price of eth
        return (((assetPrice * _amount) / 1e18) * (10 ** 6)) / (10 ** 18);
// this will return 0 even though 1e12 
    }    

Impact

resulting in both users loosing funds and needlessly putting pressure on the rebalance() function by recieving token without minting appropriate amount of USSD

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L172

Tool used

Manual Review

Recommendation

require that the returned value is not 0.