# `Usd0PP.sol::_deconstruct()` is always called with `msg.sender` despite having receiver arguments Low/Info · Sherlock · Stablecoin issuer · 11th November 2025 Finding L-1 of the Usual bUSD0 Upgrade security review. - Protocol: https://usual.money/ - Report: /reports/usual-busd0-upgrade - Source: https://github.com/0xsimao/audits/blob/main/Sherlock/private-audits/2025-11-11-usual-ii.pdf --- ## Summary `Usd0PP.sol::_deconstruct()` is currently always called with `msg.sender` for both receiver arguments, so separate functions to mint with flexible receiver are missing. ## Vulnerability Detail The function is defined as `function _deconstruct(uint256 amountUsd0, address bAssetRecipient, address rAssetRecipient)`, but in the code only `Usd0PP.sol::mint()` and `Usd0PP.sol::mintWithPermit()` are exposed, and they don't allow to specify different recipients, so the functionality is not fully implemented. ## Impact Missing functionality. ## Code Snippet https://github.com/sherlock-audit/2025-11-usual-usd0-upgrade-nov-11th/blob/main/core-protocol/src/token/Usd0PP.sol#L226-L239 ## Tool Used Manual Review ## Recommendation Add separate mint functions that allow receivers other than `msg.sender`. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Depositing to another receiver othan than `msg.sender` will lead to stuck funds by increasing `avgStart` without claiming](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-othan-stuck-increasing-avg): Exactly Protocol Update - Staking Contract - [_handleSwapAction(...) creates situations where the arguments receiver and sweeper need to be the same address in BaseRouter](https://0xsimao.com/findings/fuji-finance-handle-creates-situations-sweeper): Fuji Finance - [`Borrowing::redeemYields` debits `ABOND` from `msg.sender` but redeems to `user` using `ABOND.State` data from `user`](https://0xsimao.com/findings/autonomint-redeem-yields-debits-redeems): Autonomint - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO