J4de - USSDRebalancer.sol#SellUSSDBuyCollateral will not sell any collateral if the collateralFactor is too high

[sherlock-admin]

J4de

high

USSDRebalancer.sol#SellUSSDBuyCollateral will not sell any collateral if the collateralFactor is too high

Summary

USSDRebalancer.sol#SellUSSDBuyCollateral will not sell any collateral if the collateralFactor is too high. Cause after the USSD price rises, it cannot be adjusted.

Vulnerability Detail

1. The vulnerability

File: USSDRebalancer.sol
177       // total collateral portions
178       uint256 cf = IUSSD(USSD).collateralFactor();
179       uint256 flutter = 0;
180       for (flutter = 0; flutter < flutterRatios.length; flutter++) {
181         if (cf < flutterRatios[flutter]) {
182           break;
183         }
184       }

If the collateralFactor exceeds all flutterRatios, the for loop will not break, and finally flutter will accumulate to flutterRatios.length.

189       for (uint256 i = 0; i < collateral.length; i++) {
190         uint256 collateralval = IERC20Upgradeable(collateral[i].token).balanceOf(USSD) * 1e18 / (10**IERC20MetadataUpgradeable(collateral[i].token).decimals()) * collateral[i].oracle.getPriceUSD() / 1e1    8;
191 >>      if (collateralval * 1e18 / ownval < collateral[i].ratios[flutter]) {
192           portions++;
193         }
194       }

collateral[i].ratios[flutterRatios.length] is 0 (Because the index exceeds the upper limit of the array). So no collateral will be sell.

2. How to make the collateralFactor bigger

to call mintForToken function to mint USSD, The collateralFactor will get bigger.

Impact

SellUSSDBuyCollateral fucntion no longer works in some scenarios

Code Snippet

https://github.com/USSDofficial/ussd-contracts/blob/f44c726371f3152634bcf0a3e630802e39dec49c/contracts/USSDRebalancer.sol#L180-L184

Tool used

Manual Review

Recommendation

      uint256 cf = IUSSD(USSD).collateralFactor();
      uint256 flutter = 0;
      for (flutter = 0; flutter < flutterRatios.length; flutter++) {
        if (cf < flutterRatios[flutter]) {
          break;
        }
      }
+      
+     if (flutter == flutterRatios.length) {
+         flutter = flutterRatios.length - 1;
+     }

      CollateralInfo[] memory collateral = IUSSD(USSD).collateralList();
      uint portions = 0;
      uint ownval = (getOwnValuation() * 1e18 / 1e6) * IUSSD(USSD).totalSupply() / 1e6; // 1e18 total USSD value
      for (uint256 i = 0; i < collateral.length; i++) {
        uint256 collateralval = IERC20Upgradeable(collateral[i].token).balanceOf(USSD) * 1e18 / (10**IERC20MetadataUpgradeable(collateral[i].token).decimals()) * collateral[i].oracle.getPriceUSD() / 1e18;
        if (collateralval * 1e18 / ownval < collateral[i].ratios[flutter]) {
          portions++;
        }
      }

Duplicate of #889