# rebalance process incase of  selling the collateral, could revert because of underflow calculation

USSD rebalance() underflows when Uniswap swap returns more baseAsset than amountToBuyLeftUSD, reverting collateral sales during peg-down.

- Payout: Contest reward
- Severity: medium
- Program: USSD
- Credited: 0xHati
- Disclosed: 2023-05-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-USSD-judging/issues/111
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-USSD%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** USSDRebalancer.sol rebalance() collateral sell path
**Root cause:** amountToBuyLeftUSD is decremented by the actual baseAsset received from the Uniswap swap, but oracle-priced amountToSellUnits does not guarantee received amount <= amountToBuyLeftUSD, so the subtraction underflows.
**Steps:**
1. Call rebalance() when USSD is below peg so BuyUSSDSellCollateral() runs.
2. In branch collateralval > amountToBuyLeftUSD, amountToSellUnits is computed from oracle price and swapped via UniV3SwapInput.
3. If actual baseAsset received (balanceOf(USSD) - amountBefore) exceeds amountToBuyLeftUSD, `amountToBuyLeftUSD -= (...)` underflows and reverts.
4. Same underflow occurs in the collateralval < amountToBuyLeftUSD branch when selling all collateral.
**How found:** Code review of rebalance() arithmetic: noticed the decrement uses realized swap output while the sell size is derived from oracle price, so realized output can exceed the remaining target.
**Insight:** When a function decrements a target by a realized swap/transfer amount, check whether the realized amount is bounded by the target; oracle-priced sizing plus slippage can exceed it and underflow.