# Dangerous assumption on the peg of USDC can lead to manipulations

Isomorph hardcoded USDC and sUSD at $1 when pricing Velodrome/Synthetix collateral, letting depegged stablecoins misprice collateral and skew liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Isomorph
- Credited: yixxas
- Disclosed: 2022-11-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-isomorph-judging/issues/224
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-6
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** Solidity collateral pricing contracts (DepositReceipt_USDC, Vault_Synths)
**Root cause:** Collateral valuation assumes USDC and sUSD are exactly $1 instead of reading a live oracle price, so pool liquidity and synth collateral are priced off a fixed peg.
**Steps:**
1. Read `DepositReceipt_USDC.sol#L100/L123`: `value0 = token0Amount * SCALE_SHIFT` treats USDC amount as USD value.
2. Observe other pool token priced via `router.getAmountOut(HUNDRED_TOKENS, token1, USDC)` then compared to Chainlink USD price (L87-L98).
3. Note `Vault_Synths.sol#L76` prices synths via `effectiveValue(_currencyKey,_amount,SUSD_CODE)` assuming sUSD=$1.
4. When USDC/sUSD depegs, collateral is valued at $1 regardless of market price, enabling arbitrage and skewed liquidation thresholds.
**How found:** Code review of collateral pricing functions, spotting hardcoded $1 assumptions versus real market/oracle prices.
**Exploitation:** Borrower deposits depegged USDC/sUSD collateral valued at $1 on Isomorph while worth less on market, avoiding liquidation and minting over-valued isoUSD; conversely a premium peg triggers unfair liquidations.
**Insight:** When a protocol prices LP or synth collateral, check whether any leg is treated as a constant $1 stablecoin rather than oracle-priced; depeg events turn that constant into an arbitrage and liquidation-threshold exploit.