Lybra Finance - 0xgrbr's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/pools/LybraRETHVault.sol#L47 https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/pools/LybraWbETHVault.sol#L35

Vulnerability details

Impact

The contracts for RETH Token and WBETH Token lack the exchangeRatio() function, which will revert any deposit to these Vaults. This omission can have significant consequences for users interacting with these contracts.

Proof of Concept

Regarding RETH, the provided interface for RocketTokenRETHInterface.sol does not include the required function. Instead, the smart contract should call the getEthValue() function. You can find the interface code at the following location: https://github.com/rocket-pool/rocketpool/blob/master/contracts/interface/token/RocketTokenRETHInterface.sol#L8

For WBETH, no open source documentation or GitHub repository was found. However, you can verify the code on Etherscan by referring to the provided address: 0x523177fbe442afb70b401d06bb11ec7b8684ecee (proxyContract). The relevant file to inspect is StakedTokenV1.sol#L256.

Tools Used

Manual Review

Recommended Mitigation Steps

To address the issues identified, the following mitigation steps are recommended:

For LybraRETHVault.sol:

Modify the IRETH interface to include the getEthValue() function:

interface IRETH {
    function getEthValue(uint256 _rethAmount) external view returns (uint256);  
}

Update the getAssetPrice() function in LybraRETHVault.sol as follows:

function getAssetPrice() public override returns (uint256) {
    return (_etherPrice() * IRETH(address(collateralAsset)).getEthValue(1e18)) / 1e18;
}

For WBETH using the address 0xa2E3356610840701BDf5611a53974510Ae27E2e1: Change exchangeRatio to exchangeRate in the IWBETH interface:

interface IWBETH {
    function exchangeRate() external view returns (uint256);
    function deposit(address referral) external payable;
}

Modify the getAssetPrice() function in LybraRETHVault.sol accordingly:

function getAssetPrice() public override returns (uint256) {
    return (_etherPrice() * IWBETH(address(collateralAsset)).exchangeRate()) / 1e18;
}

It's important to note that while inspecting the WBETH contract, it was observed that the exchangeRate value is derived from an off-chain oracle update, likely sourced from Binance. This information should be taken into account and used with caution when utilizing the function.

Assessed type

Error