Asymmetry contest - ast3ros's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/0e826f307866f3b9e737a3fd7b860e1df2dd7e71/contracts/SafEth/SafEth.sol#L73 https://github.com/code-423n4/2023-03-asymmetry/blob/0e826f307866f3b9e737a3fd7b860e1df2dd7e71/contracts/SafEth/SafEth.sol#L92-L94 https://github.com/code-423n4/2023-03-asymmetry/blob/0e826f307866f3b9e737a3fd7b860e1df2dd7e71/contracts/SafEth/derivatives/Reth.sol#L212-L215

Vulnerability details

Impact

Late stakers may gain an unfair advantage compared to early stakers when staking to the SafETH contract. This can happen because ethPerDerivative may be calculated differently in underlyingValue and derivativeReceivedEthValue when depositing to Reth derivative.

Proof of Concept

When calculating the amount of SafETH to mint:

1. The underlyingValue is calculated using the whole balance in the derivative contract as input for the ethPerDerivative function: derivatives[i].ethPerDerivative(derivatives[i].balance()).

           underlyingValue +=
                (derivatives[i].ethPerDerivative(derivatives[i].balance()) *
                    derivatives[i].balance()) /
                10 ** 18;

The input for ethPerDerivative function is whole balance in derivative contract: derivatives[i].ethPerDerivative(derivatives[i].balance())

https://github.com/code-423n4/2023-03-asymmetry/blob/0e826f307866f3b9e737a3fd7b860e1df2dd7e71/contracts/SafEth/SafEth.sol#L73

2. The derivativeReceivedEthValue is calculated using only the depositAmount as input for the ethPerDerivative function: derivative.ethPerDerivative(depositAmount).

            uint derivativeReceivedEthValue = (derivative.ethPerDerivative(
                depositAmount
            ) * depositAmount) / 10 ** 18;

https://github.com/code-423n4/2023-03-asymmetry/blob/0e826f307866f3b9e737a3fd7b860e1df2dd7e71/contracts/SafEth/SafEth.sol#L92-L94

3. When the derivative is Reth, depending on the amount, ethPerDerivative will be taken from either UniswapV3 or RocketTokenPool.

        if (poolCanDeposit(_amount))
            return
                RocketTokenRETHInterface(rethAddress()).getEthValue(10 ** 18);
        else return (poolPrice() * 10 ** 18) / (10 ** 18);

https://github.com/code-423n4/2023-03-asymmetry/blob/0e826f307866f3b9e737a3fd7b860e1df2dd7e71/contracts/SafEth/derivatives/Reth.sol#L212-L215

Therefore, the value of ethPerDerivative in (1) can be different from (2) because derivatives[i].balance() can be significantly different than depositAmount.

The following scenario is likely to happen:

• derivatives[i].balance() is large, therefore ethPerDerivative is derived from UniswapV3. 1 RETH = 1.0661 WETH (price at time T 28/03).
• depositAmount is small, therefore ethPerDerivative is derived from RocketTokenPool. 1 RETH = 1.06911 WETH (price at time T 28/03).

This leads to underlyingValue being understated or derivativeReceivedEthValue being overstated, which in turn leads to late stakers receiving more SafETH.

Tools Used

Manual

Recommended Mitigation Steps

Using the same price when calculating the underlyingValue and the derivativeReceivedEthValue for RETH derivative when calculating the mintAmount to remain ratio valueETH/totalSupply. When calculating the mintAmount, it’s important to use the same price when calculating both the underlyingValue and the derivativeReceivedEthValue for RETH derivative. It helps remain underlyingValue/totalSupply.