# If jUSD depegs, it will get in a death spiral

Jigsaw's borrow() mints jUSD using the live jUSD exchange rate, so a depeg lets users mint more jUSD than collateral value, deepening the depeg.

- Payout: Contest reward
- Severity: high
- Program: Jigsaw
- Credited: phil
- Disclosed: 2025-08-11
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_jigsaw_june2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** jUSD stablecoin borrow/mint function in Manager.sol
**Root cause:** jUsdMintAmount divides collateral USD value by manager.getJUsdExchangeRate(); when jUSD trades below 1e18, the divisor shrinks and more jUSD is minted per unit of collateral value.
**Steps:**
1. Observe borrow() computes jUsdMintAmount = amountValue * exchangeRatePrecision / manager.getJUsdExchangeRate()
2. Assume jUSD depegs to 0.90e18
3. Deposit $1,000 of collateral
4. Mint amount = 1000 * 1e18 / 0.9e18 = 1,111 jUSD
5. Receive more jUSD than collateral USD value, sell to extract value and worsen depeg
**How found:** Code reading of borrow(): noticed the mint amount is divided by the live jUSD exchange rate rather than using collateral USD value directly, then reasoned about behavior when that rate falls below 1e18.
**Exploitation:** During a depeg, an attacker deposits collateral and mints jUSD at the discounted exchange rate, obtaining jUSD worth more than the collateral posted, then sells it, pushing the peg further down in a reflexive loop.
**Escalation:** Reflexive death spiral: each mint-and-dump cycle lowers the exchange rate, increasing the mint ratio and accelerating the depeg.
**Insight:** In CDP stablecoin mints, check whether the mint ratio reads a market/oracle exchange rate that moves with the peg; any divisor tied to the stablecoin's own price creates a reflexive mint-more-when-cheaper loop.