Asymmetry contest - cryptothemex's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L71-L81

Vulnerability details

Impact

Loss of precision in calculating preDepositPrice value allows users to mint/ receive more safeEth.

Proof of Concept

underlyingValue is being computed by dividing the derivate balance by 10**18 [L71-L75] (https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L71-L75). Later, preDepositPrice is computed as preDepositPrice = (10 ** 18 * underlyingValue) / totalSupply;

First dividing and then multiplying cause loss of precision in preDepositPrice (setting it to lesser than the actual value). Thus, increasing the mintAmount as it is computed by mintAmount = (totalStakeValueEth * 10 ** 18) / preDepositPrice; [L98] (https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L98)

Tools Used

Code Review

Recommended Mitigation Steps

Do not divide underlyingValue by 1018 and do not multiply preDepositPrice by 1018 to compute actual mintAmount.