# Incorrect Assumption of Stablecoin Market Stability

StableVault mints/burns a single token 1:1 across stablecoins with differing real prices, letting attackers arbitrage depegged assets for profit.

- Payout: Contest reward
- Severity: high
- Program: Tigris Trade
- Credited: 0xsomeone
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/462
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** StableVault.sol deposit/withdraw stablecoin vault
**Root cause:** StableVault treats all supported stablecoins as equal value, minting and burning the vault token 1:1 regardless of actual market prices, so inflows/outflows are mispriced.
**Steps:**
1. Deposit a cheaper stablecoin (e.g. USDC at 0.99994853 USD) via `deposit` to mint vault tokens 1:1.
2. Withdraw a more valuable stablecoin (e.g. USDT at 1.00000000 USD) via `withdraw` at 1:1.
3. Sell acquired USDT back for USDC on Curve 3pool to realize arbitrage profit.
4. Scale with a flash loan instead of personal capital.
**How found:** Warden observed StableVault groups multiple stablecoins under one token with 1:1 mint/burn, then compared real stablecoin prices from Curve pools and Chainlink oracles to spot the mispricing.
**Exploitation:** Attacker deposits the lower-priced stablecoin into StableVault, receives vault tokens 1:1, withdraws the higher-priced stablecoin, then sells it on an external stablecoin pool (Curve) for more of the original asset than deposited, capturing the price differential; flash loans remove capital constraints.
**Escalation:** Arbitrage can be repeated and amplified with flash loans, continuously draining value from depositors who take the losing side.
**Insight:** When a vault accepts multiple assets as interchangeable, compare each asset's oracle/market price against the assumed 1:1 ratio; any depeg creates a deposit-cheap/withdraw-expensive arbitrage, especially flash-loanable.