Asymmetry contest - Evo's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L63-L101

Vulnerability details

Impact

A staker will lose his Eth funds into SafEth contract permanently without any chance to unstake them

Proof of Concept

After SafEth gets deployed, the admin still has to add the derivatives by addDerivative. in this case any user as staker might try and call stake() function before that which will cause a loss of his funds in SafEth contract.

if someone use stake() function before any derivative added, it will pass successfully, and the staker receives 0 share and still losing his funds.

So it goes like this: a staker would call stake function and his Eth amount goes to SafEth contract without having any of SafEth ERC20 token in return. According to that he will not be able to unstake later on because he doesn't have SafEth tokens to burn.

<br/>

Tools Used

Manual Review <br/>

Recommended Mitigation Steps

Add this check on the stake() function in the beginning:

require(derivativeCount > 0, "No derivative is added");