Submitted by critical-or-high
The following contracts in the protocol doesnt use RateLimitedMinter:
For the SimplePSM case, it leads to governance attacks. An attacker with a sufficient USDC balance can exploit this by minting an unlimited amount of gUSDC tokens in SimplePSM using USDC, bypassing the protocols safety parameters (1, 2, 3). This allows the attacker to propose or veto certain actions, compromising the governance process.
In the ProfitManager contract, the notifyPnL() function burns credit tokens, but the RateLimitedMinter buffer is never replenished (ProfitManager doesnt use rate limiter). On the other hand, the LendingTerm contract uses the RateLimitedMinter for minting credit tokens, resulting in the depletion of its buffer over time. This can lead to a shortage of tokens in the RateLimitedMinter buffer of LendingTerm contracts at some point.
Put the Poc inside the test/unit/governance/Poc4.t.sol file and run it with the following command:
Use rate limiter across all contracts in the protocol when minting or burning Credit and Guild tokens.
Governance
eswak (Ethereum Credit Guild) acknowledged, but disagreed with severity and commented:
OneTrueKirk (Ethereum Credit Guild) commented:
TrungOre (judge) decreased severity to Medium
Blckhv (warden) commented:
TrungOre (judge) commented:
Note: For full discussion, see here.
