Krace - Users can still redeem their assets even after the collateral has been disabled.

[sherlock-admin]

Krace

high

Users can still redeem their assets even after the collateral has been disabled.

Summary

The collectRedemption function, responsible for collecting collateral tokens after redeeming Ubiquity Dollars, currently lacks a check to verify whether the collateral has been disabled. This omission could allow users to redeem disabled collateral from the contract.

Vulnerability Detail

Redeem process is split in two steps:

1. redeemDollar() will burn users' Ubiquity Dollar and record the amounts of collateral users could receive.

    function redeemDollar(
        uint256 collateralIndex,
        uint256 dollarAmount,
        uint256 collateralOutMin
    )
        internal
        //@audit users can not redeem disabled collateral
        collateralEnabled(collateralIndex)
        returns (uint256 collateralOut)
    {

2. collectRedemption() send the collateral to the users.

    function collectRedemption(
        uint256 collateralIndex
//@audit If the collateral is disabled after redeemDollar, users could still receive the collateral
    ) internal returns (uint256 collateralAmount) {

However, only the first function, redeemDollar, checks if the collateral is enabled. This means that if a collateral is disabled after redeemDollar, users could still obtain the collateral through the collectRedemption function.

Impact

Users might have the ability to redeem disabled collateral from the contract.

Code Snippet

https://github.com/sherlock-audit/2023-12-ubiquity/blob/d9c39e8dfd5601e7e8db2e4b3390e7d8dff42a8e/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol#L399-L406

https://github.com/sherlock-audit/2023-12-ubiquity/blob/d9c39e8dfd5601e7e8db2e4b3390e7d8dff42a8e/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol#L476-L478

Tool used

Manual Review

Recommendation

It's recommended to add a check in the function collectRedemption.

diff --git a/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol b/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol
index 2f2a90a..8bf074c 100644
--- a/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol
+++ b/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol
@@ -475,7 +475,7 @@ library LibUbiquityPool {
      */
     function collectRedemption(
         uint256 collateralIndex
-    ) internal returns (uint256 collateralAmount) {
+    ) internal collateralEnabled(collateralIndex) returns (uint256 collateralAmount) {
         UbiquityPoolStorage storage poolStorage = ubiquityPoolStorage();

         require(

Duplicate of #23