Lybra Finance - 0xMAKEOUTHILL's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraRETHVault.sol#L9-L11

Vulnerability details

Impact

Asset price won't be correct since the function from the interface is incorrect and also doesn't even exist for the rETH token

Proof of Concept

Whenever price of asset is calculated it uses getExchangeRatio:

    function getAssetPrice() public override returns (uint256) {
        return (_etherPrice() * IRETH(address(collateralAsset)).getExchangeRatio()) / 1e18;
    }

HOWEVER when you go in the contract for the rETH token - 0xae78736Cd615f374D3085123A210448E74Fc6393. You can see that there is no such function as getExchangeRatio:

interface IRETH { 
    //@audit wrong interface function, getExchangeRate
    function getExchangeRatio() external view returns (uint256);
}

As sponsor confirmed, the right function is getExchangeRate()

Tools Used

Manual Audit

Recommended Mitigation Steps

To receive the right asset price you should:

interface IRETH {
    -- function getExchangeRatio() external view returns (uint256);
    ++ function getExchangeRate() external view returns (uint256);
}

    function getAssetPrice() public override returns (uint256) {
        -- return (_etherPrice() * IRETH(address(collateralAsset)).getExchangeRatio()) / 1e18;
        ++ return (_etherPrice() * IRETH(address(collateralAsset)).getExchangeRate()) / 1e18;
    }

Assessed type

Other