# OUSGInstantManager will allow excessive OUSG token minting during USDC depeg event

OUSGInstantManager hardcodes 1 USDC = 1 USD when minting OUSG, so during a USDC depeg users mint OUSG at full value and extract the difference.

- Payout: Contest reward
- Severity: high
- Program: Ondo Finance
- Credited: Breeje
- Disclosed: 2024-04-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-ondo-finance-findings/issues/278
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-ondo-finance%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** OUSGInstantManager mint function / RWA oracle pricing
**Root cause:** _getMintAmount assumes USDC is always worth 1 USD and never consults a USDC/USD price feed, while the OUSG oracle is constrained to ~1% deviation per 23h, so a USDC depeg is not reflected in the mint ratio.
**Steps:**
1. Observe `_mint` computes `ousgAmountOut = _scaleUp(usdcAmountIn - fees) * 1e18 / getOUSGPrice()` with no USDC price input.
2. Wait for a USDC depeg (e.g. March 2023 low of ~$0.87).
3. Call `mint(100_000e6, attacker)` paying 100k USDC worth ~87k USD.
4. Receive ~95_000e18 OUSG valued at ~$99.75k at OUSG price 105e18, capturing the depeg spread.
**How found:** Code review of the mint path: noticed _getMintAmount only divides by the OUSG oracle price and never validates USDC's market price, then reasoned about the constrained OUSG oracle making the mismatch exploitable during a depeg.
**Exploitation:** Attacker monitors USDC market price; on depeg, mints OUSG at the stale 1:1 assumption, then redeems or sells OUSG at its stable oracle price to realize the difference against the protocol.
**Insight:** When a protocol prices an input stablecoin at par, check whether any oracle validates that stablecoin's market price; constrained-output oracles (1%/23h) amplify depeg arbitrage because the output leg cannot reprice.