Renzo - Stefanov's results

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/RestakeManager.sol#L274

Vulnerability details

Impact

totalWithdrawalQueueValue is added to the totalTVL, which is used to calculate ezETH tokens that a user can mint after deposit and depositETH. If totalWithdrawalQueueValue is calculated incorectly, then users will take incorrect ezETH amount.

Proof of Concept

calculateTVLs function calculates the TVLs for each operator delegator by individual token, total for each operator delegator, and total for the protocol.

totalTVL is combination of each operator delegator TVL + address(depositQueue).balance, (address(withdrawQueue).balance & totalWithdrawalQueueValue. However, totalWithdrawalQueueValue is not calculated properly.

Total withdrawal queue value get calculated in the second of 2 for cycles. The first one cycles through all operator delegators, which we don't need for our equation, and the second cycles through all collateral tokens, which is all we need to calculate totalWithdrawalQueueValue. Unfortunately, the index from the first cycle is used. So we are taking the same collateralToken address (collateralTokens[i]) and calculating every token balance (collateralTokens[j].balanceOf(withdrawQueue)) with it.This means that every token balance will have the collateral value of collateralTokens[0]

https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/RestakeManager.sol#L317

        // record token value of withdraw queue
        if (!withdrawQueueTokenBalanceRecorded) {
@>          totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(
                collateralTokens[i],
                collateralTokens[j].balanceOf(withdrawQueue)
            );
        }

Tools Used

Manual Review

Recommended Mitigation Steps

Use the same collateralToken address position both for the token and balance position

        // record token value of withdraw queue
        if (!withdrawQueueTokenBalanceRecorded) {
            totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(
-               collateralTokens[i],
+               collateralTokens[j],
                collateralTokens[j].balanceOf(withdrawQueue)
            );
        }

Assessed type

Math