Asymmetry contest - slippopz's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/Reth.sol#L212

Vulnerability details

Impact

Detailed description of the impact of this finding.

• function ethPerDerivative(uint) of reth can be manipulated: attacker can deposit just enough to mint reth with rocketDepositPool but using uniswap pool rate to calculate mint share in function stake (SafETH contract)
• • uniswap pool rate using spot price which can be manipulated (can be a problem if pool has low liquidity)

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

• https://github.com/Kittikornl/2023-03-asymmetry
• follow readme for more details

Tools Used

foundry

Recommended Mitigation Steps

• using rate to calculate share with the same rate when minting new reth
• using twap or oracle for reth price