Asymmetry contest - n1punp's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/SfrxEth.sol#L74-L82

Vulnerability details

Impact

Stakers can lose all ETH upon unstaking (on the portion that comes from to frax pool), since the slippage control is incorrectly handled (calculated from spot price).

Proof of Concept

withdraw function in SfrxEth contract is vulnerable to sandwich attack. The pool price is calculated from spot price from Curve pool, which can easily be manipulated. minOut variable is also calculated from the manipulatable pool price. So, the potential attack vector is (steps 1,2, & 4 are sandwiched around normal user's transaction):

1. Attacker flashloans ETH out -> deposits to Frax to obtain SfrxETH -> dumps SfrxETH token price
2. Attacker provide enough liquidity (needed just enough liquidity to make sure price doesn't move too much upon swapping)
3. Normal user executes unstake which then triggers withdraw from SfrxETH -> ETH. But since SfrxETH price is dumped, the obtained ETH is very minimal. The slippage control also easily passes, since the attacker added sufficiently deep liquidity, the price won't move much, so the slippage control check will pass —> this allows the attacker to get to obtain SfrxETH using minimal ETH
4. Attacker unwinds and repays debt. (potentially swapping in other pools e.g. Balancer pool, or just hold onto tokens, since the value will go back to near peg value, so there’s minimal risk).

Tools Used

Recommended Mitigation Steps

• Don't use spot prices. Instead, it's recommended to use oracle service e.g. Chainlink (can contact them to build custom price feed), or use TWAP prices instead.
• Make unstake function also accept another slippage control that is computed off-chain. So, it'll be sth like:

  ...
  require(ethAmountToWithdraw >= _minEthWithdrawAmt, 'too few eth');
}