Renzo - siguint's results

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/519e518f2d8dec9acf6482b84a181e403070d22d/contracts/RestakeManager.sol#L318

Vulnerability details

In the calculateTVLs() function there is a loop which iterates over operator delegators and an inner loop which iterates over collateral tokens for every operator delegator. For the first operator delegator, withdrawQueueTokenBalanceRecorded is set to false, so we pass through if statement with i = 0.

if (!withdrawQueueTokenBalanceRecorded) {
    totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(
        collateralTokens[i],
        collateralTokens[j].balanceOf(withdrawQueue)
    );
}

For the first collateral token, j == 0, but if we have more than one token, totalWithdrawalQueueValue will be incorrect. We will add amount_j * price_i instead of amount_j * price_j.

Impact

Incorrect totalTVL calculation.

Tools Used

Manual Review

Recommended Mitigation Steps

if (!withdrawQueueTokenBalanceRecorded) {
    totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(
        collateralTokens[j],
        collateralTokens[j].balanceOf(withdrawQueue)
    );
}

Assessed type

Loop