# Hardcoded stablecoin peg mispricing

Code assumes a stablecoin or LST equals its peg asset at 1:1 without checking market price

_Area: DeFi oracles, liquidations and flash loans. Seen in 6 disclosed reports; latest 2024-09-06. Updated 2026-10-23._

## How it works
A protocol treats a token as always worth its peg (USDC = 1 USD, stETH = ETH, any stablecoin = any other) and never reads a market price for that token. The assumption holds in calm markets and breaks during a depeg. When it breaks, the protocol still mints, swaps or exits at par, so a user can enter cheap on the market and leave at full value through the protocol, or the reverse. The root cause is a missing price input on one leg of a conversion, not a math bug.

## Where it shows up
- Mint/burn or deposit/withdraw functions that convert between a stablecoin or LST and a peg asset with a fixed ratio and no oracle call.
- A price used for one leg (e.g. the output token) while the other leg is hardcoded at par.
- Output oracles with slow deviation limits (e.g. ~1% per 23h) that cannot track a fast depeg on the input leg.
- Exit logic that prices asset A but swaps asset B (stETH priced as WETH).
- Vaults accepting several stablecoins as interchangeable at 1:1.
- Deploy-time pool seeding at a fixed nominal ratio (0.1/0.1) regardless of real asset values.

## How to review
The invariant: every conversion between two assets must use a price for each asset, or prove the two are the same asset. For each mint/burn/swap/exit path, list the assets in and out and confirm each is priced from a source that can move with the market. Check that the pricing asset matches the swapped asset. Check whether any oracle on either leg is rate-limited or pegged, and whether a depeg on the other leg can be arbitraged against it. For seeded pools, compare the seed ratio to real prices.

## Variants seen
- Mint at par against a depegging stablecoin with a slow output oracle [E1](https://bugbountylibrary.com/r/c4%3A2024-03-ondo-finance%3AH-01.md).
- LST priced as its peg asset, so minOut is wrong and exits revert on depeg [E2](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-01.md).
- Fixed-ratio pool seeding creating instant arbitrage [E3](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md).
- Multi-stablecoin vault minting/burning 1:1 across differing real prices [E4](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-08.md).

## Impact and severity
Value extraction from the protocol during depegs (excess minting, arbitrage) [E1](https://bugbountylibrary.com/r/c4%3A2024-03-ondo-finance%3AH-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md)[E4](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-08.md), and blocked exits or reverts that lock users out [E2](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-01.md). Severity rises when the mispriced leg is large, the depeg is fast, and the oracle on the other leg is rate-limited so it cannot correct in time [E1](https://bugbountylibrary.com/r/c4%3A2024-03-ondo-finance%3AH-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-03-ondo-finance%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-08.md