Asymmetry contest - n33k's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L63-L101

Vulnerability details

Impact

The protocol is vulnerable to the well know inflation attack/first deposit bug. The attacker can steal assets from other user's stakes.

Reference cases:

Overview of the Inflation Attack Fist deposit bug

The Bug

The share calculation uses the ERC20 balance of the derivates in the derivates pool. And attacker can transfer ERC20 tokens to inflate the balance. So that underlyingValue&preDepositPrice will be inflated. And the mint amount mintAmount will be deflated.

        // Getting underlying value in terms of ETH for each derivative
        for (uint i = 0; i < derivativeCount; i++)
            underlyingValue +=
                (derivatives[i].ethPerDerivative(derivatives[i].balance()) *
                    derivatives[i].balance()) /
                10 ** 18;

        uint256 totalSupply = totalSupply();
        uint256 preDepositPrice; // Price of safETH in regards to ETH
        if (totalSupply == 0)
            preDepositPrice = 10 ** 18; // initializes with a price of 1
        else preDepositPrice = (10 ** 18 * underlyingValue) / totalSupply;
        ....

        // mintAmount represents a percentage of the total assets in the system
        uint256 mintAmount = (totalStakeValueEth * 10 ** 18) / preDepositPrice;
        _mint(msg.sender, mintAmount);

Steps to attack:

1. Once the contracts has been deployed, the attacker mints a small shares.

2. Then the attacker does a plain underlying token transfer to the derivate contract, artificially inflating the derivatives[i].balance() value.

Due to the above steps, during the next legitimate user deposit, the mintAmount value for the user will become less than 1 and essentially be rounded down to 0 by Solidity. Hence the user gets 0 share against his deposit and the SafETH entire supply is held by the Attacker.

The Attacker can then simply unstake his SafETH balance for the entire underlying token balance of the entire protocol.

Proof of Concept

Tools Used

Manual Review

Recommended Mitigation Steps

Mint a same amount of SafETH to ZERO address on the first stake.

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L88

Vulnerability details

Impact

User loses eth dust to SafETH contract.

Proof of Concept

In stake function, eth amount deposited to each derviative is calculated as

uint256 ethAmount = (msg.value * weight) / totalWeight;

becasue of the divsion, all the ethAmount sums up may not equal msg.value. Thus leaves some eth dust inside SafETH contract.

Tools Used

Manual Review

Recommended Mitigation Steps

refund dust eth at the end of stake function.