Asymmetry contest - 019EC6E2's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/SafEth.sol#L91-L94 https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/derivatives/Reth.sol#L237-L240

Vulnerability details

Impact

Users depositing into SafETH may fall victim to sandwich attacks, resulting in a total loss of funds. The victim receives 0 SafETH regardless of the deposit amount. In the worst-case scenario, the attacker can retrieve the entire sum of the victim's ETH back from the pool.

Proof of Concept

This vulnerability has two aspects. First, poolPrice() in Reth is vulnerable to Flashloan attacks, which are partially mitigated by maxSlippage.

The issue emerges when the victim's funds are not routed through the Uniswap router for the swap. In this situation, the RETH tokens will be deposited into the RocketPool, and the price calculation will function correctly in most cases.

Assume that the victim's transaction amount (V) is between (RETHPoolMaxSupply - RETHPoolCurrentSupply) / 2 and RETHPoolMaxSupply. In this case, the swap will go through the RocketPool, passing maxSlippage checks. However, because this exact victim's transaction exhausted the RocketPool's ability to accept deposits, the next SafETH's call to RETH.ethPerDerivative() will use the UniswapV3 Pool for price calculation, which is imbalanced due to the attacker's flashloan and returns approximately 0.

The issue is worsened by the conversion that rounds already small SQRTPrice exactly to 0. Essentially, when calling SafETH stake() and providing value, the victim will receive nothing in return. The funds will be distributed among SafETH stakers, with the attacker being one of them and enjoying the profit.

Tools Used

Foundry

Recommended Mitigation Steps

1. Use TWAP to fetch UniswapV3 poolPrice in RETH Derivative. Example in gist

Additional Information

Attack Proof of Concept in gist. Full repo with Foundry test is available by request.