highLogic errorEVM-Solidity
DittoETH: Incorrect accounting bug of the `yDUSD` vault leads to total loss of depositors' `DUSD` assets
- Payout
- $0
- Protocol
- DittoETH
- Disclosed
- Jul 29, 2024
- Source
- code4rena
DittoETH's yDUSD is an ERC4626-compliant yield vault whose share accounting can be permanently corrupted by the protocol's own discount-minting routine. When a market match executes below the oracle price, _matchIsDiscounted() mints a DUSD discount (newDebt) d …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-07-dittoeth-findings/issues/7
- https://github.com/code-423n4/2024-07-dittoeth-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.