Asymmetry contest - mert_eren's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/44b5cd94ebedc187a08884a7f685e950e987261c/contracts/SafEth/SafEth.sol#L77-L101

Vulnerability details

Impact

When totalsuply=0 in safeth contract, there is a inflation attack risk.

Proof of Concept

Attack steps are:

1. malicious user see normal user pending stake function with msg.value:1 ether(1 ether just for give number.). 2)malicious user frontrun first stake 0.5ether stake and unstake 0.5ether-1 so totalsupply=1 right now. 3)malicious user send derivative token value of 1 eth to corresponding corresponding contract in system. 4)After that totalSupply=1 and underLyingValue=1 ether+1 5)Normal user's 1 eth will go to contract and take 1018*1/(1018+1)=0 token. 6)Now malicious user can unstake 1 token and take 2 ether(1 ether come from normal user's so hacker steal it.)

Tools Used

Recommended Mitigation Steps

Protocol can make first deposit for preventing this attack.