# Price disparities between spot and perpetual pricing can heavily destabilize UXD

PerpDepository mints UXD equal to vUSD from shorting ETH on Perp, pegging UXD to vUSD not USD; perp-spot premium lets users mint and dump UXD for profit.

- Payout: Contest reward
- Severity: medium
- Program: Uxd
- Credited: 0x52
- Disclosed: 2022-12-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/305
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** PerpDepository.sol deposit() minting logic
**Root cause:** deposit() returns the vUSD quoteAmount from _openShort rather than the spot value of the deposited ETH, so minted UXD tracks the perpetual price instead of USD.
**Steps:**
1. Observe Perp perpetual ETH trades at $1530 while spot is $1500
2. Buy 1 ETH on spot for $1500
3. Call PerpDepository.deposit(assetToken, 1e18) which shorts and returns quoteAmount=1530 vUSD
4. Receive 1530 UXD minted
5. Swap 1530 UXD for 1530 USDC, netting $30 profit
6. Repeat until perp premium arbitraged down or UXD depegs to ~$0.98
**How found:** Code reading of deposit() noting the returned quoteAmount comes from the perp short swap, revealing the mint amount is denominated in vUSD rather than spot USD.
**Exploitation:** Arbitrageur buys ETH at spot, deposits into PerpDepository to mint UXD at the inflated perp price, then sells UXD for stablecoins, extracting the spread and pushing UXD below peg.
**Insight:** When a stablecoin mint path prices collateral via a derivative/AMM quote rather than a spot oracle, check whether the quote can diverge from the underlying asset and be arbitraged against the peg.