The missing check usdaPrice and usdtPrice in redeemUSDT() will cause USDT token drained.

In  CDS.sol:redeemUSDT, users can use USDa token to redeem USDT token.

We will calculate the redeemed USDT amount according to the usdaPrice and usdtPrice. The problem is that usdaPrice and usdtPrice belong to the users’ input. Malicious users can manipulate the usdaPrice and usdtPrice to drain all USDT tokens in the treasury.

    function redeemUSDT(
        CDSInterface.Interfaces memory interfaces,
        uint256 burnedUSDaInRedeem,
        uint128 usdaAmount,
        uint64 usdaPrice,
        uint64 usdtPrice
    ) external returns (uint256) {
        // according to usdt/usda's price, calculate the usdt amount.
        uint128 usdtAmount = ((usdaPrice * usdaAmount) / usdtPrice);
        ...
}

N/A

N/A

N/A

All USDT tokens will be drained via manipulating the usdaPrice and usdtPrice.

N/A

Verify the input UDSA/USDT price.