lambdaclass / lambdaclass/eth-agent
Stablecoin USD conversion assumes 1:1 peg (depeg risk)
Open
Nobody has claimed this yet.
critical
security
- Dominant language
- TypeScript
- Stars
- 10
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
Problem
normalizeToUSD assumes all stablecoins are 1:1 with USD. During depegs (like USDC in March 2023), this could allow exceeding intended USD limits.
Location
src/agent/limits.ts:183-195
Current Code
// Assumes 1:1 USD peg for all stablecoins
private normalizeToUSD(amount: bigint, stablecoin: StablecoinInfo): bigint {
// Just converts decimals, no price check
}
Recommendation
- Document the 1:1 assumption clearly in public API
- Optional: integrate price oracle for accurate conversion
- Add monitoring/alerting for depeg scenarios
- Consider adding a configurable price tolerance threshold
Priority
Critical - Financial Risk
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading src/agent/limits.ts:183-195 and the public API around normalizeToUSD. The issue lists documentation, an oracle, monitoring, and a configurable tolerance as possible approaches but does not choose one. Done requires a defined mitigation for stablecoin depegs and corresponding validation, with scope agreed before implementation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100