Mento audit contest

A public audit contest on Sherlock (stablecoin), completed on 24th October 2024. 0xSimao placed #1. 5 of his findings are published: 5 medium.

What Mento is

Mento issues local-currency stablecoins on Celo, cUSD and kin, exchanging them against a reserve through virtual AMM pools with oracle-guarded pricing, flow limits and a UBI-adjacent minting path.

Scope

The Sherlock competition covered the broker and reserve machinery: mint pricing and rounding, supply-contribution accounting on sells, trading limits as flows change direction, and the ratio scalars normalising decimals.

Medium severity findings

• User to sell the last supply will make the exchange contribution forever stuck
• GoodDollarExchangeProvider::mintFromExpansion() will change the price due to a rounding error in the new ratio
• Malicious user may frontrun GoodDollarExpansionController::mintUBIFromReserveBalance() to make protocol funds stuck
• TradingLimits::update() incorrectly only rounds up when deltaFlowUnits becomes 0, which will silently increase trading limits
• _getReserveRatioScalar() will give a lesser value than expected

The contest

View the contest page