Platform: Code4rena
Start Date: 24/03/2023
Pot Size: $49,200 USDC
Total HM: 20
Participants: 246
Period: 6 days
Judge: Picodes
Total Solo HM: 1
Id: 226
League: ETH
Rank: 245/246
Findings: 1
Award: $0.07
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: HHK
Also found by: 019EC6E2, 0Kage, 0x52, 0xRobocop, 0xTraub, 0xbepresent, 0xepley, 0xfusion, 0xl51, 4lulz, Bahurum, BanPaleo, Bauer, CodeFoxInc, Dug, HollaDieWaldfee, IgorZuk, Lirios, MadWookie, MiloTruck, RedTiger, Ruhum, SaeedAlipoor01988, Shogoki, SunSec, ToonVH, Toshii, UdarTeam, Viktor_Cortess, a3yip6, auditor0517, aviggiano, bearonbike, bytes032, carlitox477, carrotsmuggler, chalex, deliriusz, ernestognw, fs0c, handsomegiraffe, igingu, jasonxiale, kaden, koxuan, latt1ce, m_Rassska, n1punp, nemveer, nowonder92, peanuts, pontifex, roelio, rvierdiiev, shalaamum, shuklaayush, skidog, tank, teddav, top1st, ulqiorra, wait, wen, yac
0.0677 USDC - $0.07
https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/derivatives/SfrxEth.sol#L115-L117 https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/derivatives/SfrxEth.sol#L74-L75
In SfrxEth, the ethPerDerivative function utilizes the FrxETH/ETH pool's price to calculate the derivative's price, which should return a value of approximately 1e18. However, curve pools can sometimes be imbalanced, as seen in this example: https://twitter.com/LidoFinance/status/1437124279057977344. This can cause the derivative's ETH price to drop significantly below 1e18, which, in turn, could decrease the minOut value of the withdraw function. If a user unstakes their funds during a FrxETH/ETH pool imbalance, they may experience partial loss of their ether.
https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/derivatives/SfrxEth.sol#L115-L117 https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/derivatives/SfrxEth.sol#L74-L75
Manual
It may be advisable to set a minimum threshold for the price oracle of the IFrxEthEthPool contract at FRX_ETH_CRV_POOL_ADDRESS. This will help prevent the derivative's ETH price from falling below a certain level, thereby reducing the risk of loss for users.
#0 - c4-pre-sort
2023-04-02T19:10:43Z
0xSorryNotSorry marked the issue as low quality report
#1 - c4-pre-sort
2023-04-04T21:37:34Z
0xSorryNotSorry marked the issue as primary issue
#2 - liveactionllama
2023-04-06T17:38:19Z
Removing low quality report on behalf of the Lookout, so that this issue can still be reviewed by the sponsor.
#3 - c4-sponsor
2023-04-07T17:25:25Z
toshiSat marked the issue as sponsor acknowledged
#4 - c4-judge
2023-04-23T12:19:33Z
Picodes marked the issue as partial-50
#5 - c4-judge
2023-04-23T12:19:46Z
Picodes marked the issue as duplicate of #142
#6 - c4-judge
2023-04-24T21:46:38Z
Picodes changed the severity to 3 (High Risk)
#7 - c4-judge
2023-04-24T21:46:38Z
Picodes changed the severity to 3 (High Risk)