040.md

Attractive Raisin Sheep

High

All exchange rates are incorrect, except in the case of ETH.

Summary

The following lines of code contain incorrect exchangeRate calculations:

• [CDS.sol: Lines 302-303] (https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L302-L303)
• [borrowLiquidation.sol: Line 187] (https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowLiquidation.sol#L187)
• [borrowing.sol: Line 239] (https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowing.sol#L239)
• [borrowing.sol: Line 294] (https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowing.sol#L294)

The exchangeRate calculated in the above locations is incorrect due to a flawed calculation logic in the price function found in MasterPriceOracle.sol.

Root Cause

The price function is returning the token price in USD instead of the exchange rate in ETH.
Refer to the following code:

• [MasterPriceOracle.sol: Lines 83-91] (https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/oracles/MasterPriceOracle.sol#L83-L91)

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

This issue can lead to significant confusion in the price calculations throughout the protocol, including the depositing and withdrawing of USDa, USDT, and collaterals. e.g: The deposit amount can often be 0 because the token price in USD is significantly less than 1e18. Then causes the transaction to revert. https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/BorrowLib.sol#L689

PoC

No response

Mitigation

To correct this issue, the following changes should be made to the code:

-    return (uint128(uint256(price_)), ethPrice);

+    return (uint128(uint256(price_) * 1e18 / ethPrice), ethPrice);