Asymmetry contest - 0xd1r4cde17a's results

Lines of code

ttps://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L72-L75 https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/Reth.sol#L211-L216 https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/Reth.sol#L212 https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/Reth.sol#L146-L149

Vulnerability details

Impact

Detailed description of the impact of this finding.

Under certain conditions, staking and unstaking may yield vastly different amounts of tokens. This is because staking calculates underlyingValue in an incorrect way for Reth when the balance staked is in the order of magnitude of rocketDAOProtocolSettingsDeposit.getMaximumDepositPoolSize().

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

The underlyingValue calculation is here. https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L72-L75

     underlyingValue +=
                    (derivatives[i].ethPerDerivative(derivatives[i].balance()) *
                        derivatives[i].balance()) /
                    10 ** 18;

The value is computed using ethPerDerivative (for Reth is here: https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/Reth.sol#L211-L216). Semantically, the underlyingValue calculation should not depend on logic in poolCanDeposit(_amount) called in https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/Reth.sol#L212 which depends on logic such as https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/Reth.sol#L146-L149.

Note that the logic in stake() https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L92-L94 depends on ethPerDerivative but the logic in unstake() does not

Tools Used

Manual

Recommended Mitigation Steps

Separate the logic used for calculating deposit values and for calculating underlyingValue