Platform: Code4rena
Start Date: 23/06/2023
Pot Size: $60,500 USDC
Total HM: 31
Participants: 132
Period: 10 days
Judge: 0xean
Total Solo HM: 10
Id: 254
League: ETH
Rank: 130/132
Findings: 1
Award: $1.32
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: bytes032
Also found by: 0xMAKEOUTHILL, 0xgrbr, 0xkazim, 0xnacho, Arz, Co0nan, CrypticShepherd, Cryptor, HE1M, Iurii3, LaScaloneta, LokiThe5th, LuchoLeonel1, MrPotatoMagic, Musaka, Qeew, RedTiger, SovaSlava, Toshii, Vagner, a3yip6, azhar, bart1e, devival, hl_, jnrlouis, kutugu, peanuts, pep7siup, qpzm, smaul
1.3247 USDC - $1.32
The Rocketpool token interface was implemented incorrectly as getExchangeRatio() instead of getExchangeRate(). Unfortunately, getassetprice() calls getExchangeRatio() which returns ZERO rendering the calculation in the function, "(_etherPrice() * IRETH(address(collateralAsset)).getExchangeRatio()) / 1e18)" ZERO as well.
Detailed description of the impact of this finding.
The effect of this is evident in depositEtherToMint(), citing the _mintPeUSD(), where one of the parameters is the getassetprice() which returned ZERO earlier. This will likely affect the amount of PeUSD to be minted which could result to a fatal loss to the user.
Manual Review
Implement the correct interface of the Rocketpool token by Changing the getExchangeRatio() to getExchangeRate(). In getAssetPrice() change getExchangeRatio() to getExchangeRate() Also in _mintPeUSD change getExchangeRatio() to getExchangeRate()
Other
#0 - JeffCX
2023-07-09T15:04:56Z
It will not return 0, it will revert
#1 - c4-pre-sort
2023-07-09T15:06:31Z
JeffCX marked the issue as duplicate of #27
#2 - c4-judge
2023-07-28T17:15:18Z
0xean marked the issue as satisfactory
🌟 Selected for report: bytes032
Also found by: 0xMAKEOUTHILL, 0xgrbr, 0xkazim, 0xnacho, Arz, Co0nan, CrypticShepherd, Cryptor, HE1M, Iurii3, LaScaloneta, LokiThe5th, LuchoLeonel1, MrPotatoMagic, Musaka, Qeew, RedTiger, SovaSlava, Toshii, Vagner, a3yip6, azhar, bart1e, devival, hl_, jnrlouis, kutugu, peanuts, pep7siup, qpzm, smaul
1.3247 USDC - $1.32
The wBETH interface is grossly misrepresented for Rocketpool interface following the comment here. The address in the comment is that of Rocketpool token.
https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L9-L13 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L35 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L28
With the consequences of the wrong interface implemented, this will render the getAssetPrice() to return ZERO. The cascading effect will also affect _mintPeUSD affecting the amount of PeUSD to be minted to the user. This will result to a loss on the part of the user.
Manual Review
Implement the correct Interface of the wBETH using the address 0xa2e3356610840701bdf5611a53974510ae27e2e1
Other
#0 - c4-pre-sort
2023-07-09T01:59:52Z
JeffCX marked the issue as duplicate of #27
#1 - c4-judge
2023-07-28T17:15:17Z
0xean marked the issue as satisfactory