Asymmetry contest - auditor0517's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/derivatives/WstEth.sol#L94

Vulnerability details

Impact

WstEth.ethPerDerivative returns stETH amount instead of ETH. stETH price is nearly same as ETH but not the same. At the moment of writing, 1ETH = 1.000965519156061458 stETH and ethPerDerivative will return a little different value.

Proof of Concept

WstEth.ethPerDerivative returns stETH amount while it should return ETH amount.

    function ethPerDerivative(uint256 _amount) public view returns (uint256) {
        return IWStETH(WST_ETH).getStETHByWstETH(10 ** 18);
    }

stETH is not the same as ETH in value at the moment. So WstEth.withdraw swaps stETH to ETH during withdrawal.

    IStEthEthPool(LIDO_CRV_POOL).exchange(1, 0, stEthBal, minOut);

The exact implementation is to get stETH price from the curve pool used in withdraw.

Tools Used

Manual Review

Recommended Mitigation Steps

Get ETH value the curve pool. We can use get_dy method of the pool.

    uint256 stETH = IERC20(WST_ETH).balanceOf(address(this));
    return IStEthEthPool(LIDO_CRV_POOL).get_dy(1, 0, stETH);

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/derivatives/Reth.sol#L240

Vulnerability details

Impact

Users can get more rETH by manipulating poolPrice() using flashloan.

Proof of Concept

Reth.deposit() swaps from ETH to rETH if the rETH pool is full by checking poolCanDeposit().

In this case, ETH will be swapped to rETH using poolPrice()

    function poolPrice() private view returns (uint256) {
        address rocketTokenRETHAddress = RocketStorageInterface(
            ROCKET_STORAGE_ADDRESS
        ).getAddress(
                keccak256(
                    abi.encodePacked("contract.address", "rocketTokenRETH")
                )
            );
        IUniswapV3Factory factory = IUniswapV3Factory(UNI_V3_FACTORY);
        IUniswapV3Pool pool = IUniswapV3Pool(
            factory.getPool(rocketTokenRETHAddress, W_ETH_ADDRESS, 500)
        );
        (uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
        return (sqrtPriceX96 * (uint(sqrtPriceX96)) * (1e18)) >> (96 * 2);
    }

But it uses the raw price instead of TWAP so it can be manipulated easily.

• An attacker noticed the rETH pool is full and Reth.deposit() will work with uniswap.
• He starts a flashloan and drops down the ETH/rETH price of uniswap.
• He deposits his ETH to the Reth contract and he gets more rETH than he should.
• Afer that, he ends the flashloan.

Tools Used

Manual Review

Recommended Mitigation Steps

We should use the TWAP price of uniswap instead of raw price.