# USD1 is priced as $1 instead of being pegged to USDT

Unitas swap prices USD1 as $1 while converting via USDT's oracle price, letting attackers mint extra USD1 when USDT depegs and profit on recovery.

- Payout: Contest reward
- Severity: medium
- Program: Unitasprotocol
- Credited: Ruhum
- Disclosed: 2023-04-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-unitasprotocol-judging/issues/48
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-unitasprotocol%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** SwapFunctions.sol swap/oracle pricing
**Root cause:** Swap conversion uses the quote token's oracle price (USDT in USD) while treating USD1 as exactly $1, so a USDT depeg skews the USD1/USDT exchange rate instead of enforcing 1:1.
**Steps:**
1. Observe `_getPriceQuoteToken` returns USDT and `oracle.getLatestPrice(USDT)` returns e.g. 0.997e18 when USDT depegs
2. Call swap with `amountType=In`, tokenIn=USDT, tokenOut=USD1, amount=100000e6
3. `_convertByFromPrice` computes `1e6 * 1e18 * 1e18 / (0.997e18 * 1e6)` = ~1.003e23 USD1 minted
4. Wait for USDT to recover to $1, swap USD1 back to USDT at 1:1-ish rate
5. Net ~300 USDT profit taken from other protocol users' USDT deposits
**How found:** Code reading of the swap path: noticed the oracle price of the quote token feeds `_convertByFromPrice` rather than a hardcoded 1:1 USD1:USDT ratio, then worked the arithmetic for a depegged USDT price.
**Exploitation:** Attacker swaps large USDT into USD1 while USDT trades below $1, receiving more USD1 than 1:1; after USDT repegs, swaps back to USDT for a risk-free profit funded by other depositors.
**Insight:** When a protocol mints a derivative stablecoin against a collateral stablecoin, check whether the swap math uses the collateral's market oracle price while assuming the derivative is exactly $1 — any depeg then becomes a free mint.