Lybra Finance - qpzm's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/d7fb18cc47ca93ecdfd7f1668614c7fb0b9179aa/contracts/lybra/pools/LybraRETHVault.sol#L47

Vulnerability details

Impact

The comment says reth address is 0xae78736Cd615f374D3085123A210448E74Fc6393. The contract does not have getExchangeRatio function.

Proof of Concept

export ETH_RPC_URL=xxx
$ cast call 0xae78736Cd615f374D3085123A210448E74Fc6393 "getExchangeRatio()" --rpc-url $ETH_RPC_URL
Error: 
(code: -32000, message: execution reverted, data: None)

$ cast call 0xae78736Cd615f374D3085123A210448E74Fc6393 "getExchangeRate()" --rpc-url $ETH_RPC_URL 
0x0000000000000000000000000000000000000000000000000eed96b572a205d7

Tools Used

Manual review.

Recommended Mitigation Steps

For rETH, use getExchangeRate. Its decimal is 18.

Assessed type

Error

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/d7fb18cc47ca93ecdfd7f1668614c7fb0b9179aa/contracts/lybra/pools/LybraWbETHVault.sol#L35

Vulnerability details

Impact

It cannot fetch the price of wBETH and thus depositEtherToMint will revert.

Proof of Concept

The comment says wbETH address is 0xae78736Cd615f374D3085123A210448E74Fc6393, but it is rETH. wBETH address is 0xa2e3356610840701bdf5611a53974510ae27e2e1 and .exchangeRatio() function is not implemented.

$ cast call 0xae78736Cd615f374D3085123A210448E74Fc6393 "getExchangeRatio()" --rpc-url https://eth-mainnet.g.alchemy.com/v2/-q9ovgIm5hecqRR7UIceeevnU2U9vdXn
Error: 
(code: -32000, message: execution reverted, data: None)

$ cast call 0xa2e3356610840701bdf5611a53974510ae27e2e1  "exchangeRate()" --rpc-url $ETH_RPC_URL
0x0000000000000000000000000000000000000000000000000dfc7377e47f5100

Tools Used

Manual review.

Recommended Mitigation Steps

Use exchangeRate. Its decimal is 18.

Assessed type

Error