OpenEden Disclosed Report

https://github.com/OpenEdenHQ/openeden.usdoexpress.audit/tree/f3f31d2ac15e3253cba342229f9d05495f95d6fd

The _instantMintInternal() function performs mint minimum and first-deposit checks by directly comparing the raw underlying token amount (amt) against global thresholds (_mintMinimum and _firstDepositAmount) that are documented to be configured with 6-decimal precision (USDC scale). However, when the underlying token uses a different decimal precision, such as 18 decimals for WETH, this direct comparison fails to account for the decimal difference.

For example, if _mintMinimum is configured as 100 USDC (100e6 with 6 decimals), the same numerical value when applied to an 18-decimal token like WETH represents only 100e6 wei, which equals approximately 1e-10 WETH. This dramatically reduces the effective minimum threshold, allowing transactions with dust amounts that bypass the intended economic controls.

The vulnerability occurs because the code performs no decimal normalization before comparing amt to the configured thresholds. While the AssetRegistry correctly handles decimal normalization for value conversion in convertFromUnderlying(), these normalized values are not used for the threshold validation checks.

        if (!_firstDeposit[to]) {
            if (amt < _firstDepositAmount) revert FirstDepositLessThanRequired(amt, _firstDepositAmount);
            _firstDeposit[to] = true;
        } else {
            if (amt < _mintMinimum) revert MintLessThanMinimum(amt, _mintMinimum);
        }

• Attacker identifies that _mintMinimum and _firstDepositAmount are hardcoded for 6-decimal precision while the protocol accepts tokens with any decimal count
• For 18-decimal tokens (WETH/WBTC), attacker deposits dust amounts like 100e6 wei (0.0000000001 WETH worth ~$0.0003) which bypasses the intended $100 minimum threshold
• The direct comparison amt < _mintMinimum fails to account for decimal differences, allowing the dust amount to pass all validation checks
• Attacker can spam thousands of dust transactions, bypassing KYC first-deposit requirements and minimum economic thresholds designed to prevent system abuse