Skip to content
Request an audit

‹ All findings

Usd0PP::mintWithPermit() no longer checks that the timestamp exceeds the bond start

Low/InfoUsual bUSD0 Upgrade·Sherlock·Stablecoin issuer·11th November 2025·by 0xSimaoL-2

Report PageSource

Summary

Usd0PP::mint() checks that the timestamp is bigger than the bond start, but Usd0PP::mintWithPermit() doesn't, which is conflicting.

Vulnerability Detail

Most of the minting logic was moved to Usd0PP::_deconstruct(), but the timestamp and bond start check wasn't, and was kept only on the mint() function, having conflicting checks compared to Usd0PP::mintWithPermit().

Impact

No impact since at the moment the timestamp is bigger than the bond start and the check is useless, but a fresh deployment could make it problematic.

Code Snippet

https://github.com/sherlock-audit/2025-11-usual-usd0-upgrade-nov-11th/blob/main/core-protocol/src/token/Usd0PP.sol#L230-L240

Tool Used

Manual Review

Recommendation

Make the checks consistent across both functions.

Discovered by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests