Bauchibred - Hubble assumes stablecoins never depeg

[sherlock-admin]

Bauchibred

medium

Hubble assumes stablecoins never depeg

Summary

After extensive discussion with the sponsors, it's been realised that Hubble values stablecoins at $1 forever and assumes it (potentially they in the case where more stablecoins are integrated in the future) never depegs, Do note that having a constant value for any stablecoin easily allows malicious usage of the protocol once a particular stable depegs, leaving the protocol to hold potential worthless tokens, in the event that the stablecoin depegs and never gets back to it's peg, even if it gets back to peg, while it was not pegged 1:1 malicious actors can easily game Hubble and make ill-gotten gains

Vulnerability Detail

See summary, and then note that the stablecoin most likely relied on within Hubble is USDC, being it's it's gas token, USDC has had multiple occurences of depegs, in one instance which happened around 4 motnhs ago (as at the time of writing this report) it depegged to a whooping 87 cents for a dollar, sorce here which means that if someone provided USDC to mint VUSD, they make an outrageous profit ~15%, i.e provide $100k worth of tokens to mint a$114,943 worth of VUSD, note that this USDC depeg, caused a storm in the market and even triggered the depegging of other s notable dollar-pegged stablecoins: DAI, USDD, and USDP, though not being a common occurence one inaccurate encounter of a serious depeg could severely deter protocol

Impact

See summary + Vulnerability detail, but in short in the case where the market price of a stablecoin drops the protocol still assumes it to be pegged

Code Snippet

• https://github.com/sherlock-audit/2023-04-hubble-exchange/blob/1f9a5ed0ca8f6004bbb7b099ecbb8ae796557849/hubble-protocol/contracts/Oracle.sol#L16C1-L16C1
• https://github.com/sherlock-audit/2023-04-hubble-exchange/blob/1f9a5ed0ca8f6004bbb7b099ecbb8ae796557849/hubble-protocol/contracts/Oracle.sol#L30C1-L32C10

Tool used

• Manual Audit
• TOB's Opyn Gamma Protocol audit report

Recommendation

Consistently fetch the real price feed of all assets, USDC/USD can be found here

Duplicate of #69