Renzo - twcctop's results

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/549f774626b71dd13a427561d4743535a9cc0dca/contracts/RestakeManager.sol#L318

Vulnerability details

Impact

calculateTVLs will not calculate the withdraw queue value correctly, because the wrong index is used.

Proof of Concept

function calculateTVLs() public view returns (uint256[][] memory, uint256[] memory, uint256) {
...

for (uint256 i = 0; i < odLength; ) {
...
 for (uint256 j = 0; j < tokenLength; ) 
...

        if (!withdrawQueueTokenBalanceRecorded) {
        totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(
 @>       collateralTokens[i],
        collateralTokens[j].balanceOf(withdrawQueue)
        );
        }

according to the code above, the wrong index is used in the collateralTokens array, i is used to stand for the operator delegator index, and j is used to stand for the token index. while collateralTokens[i] is used to get the token address, which should be collateralTokens[j] instead.

Tools Used

manual

Recommended Mitigation Steps

-  collateralTokens[i],
+  collateralTokens[j],

Assessed type

Math

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/549f774626b71dd13a427561d4743535a9cc0dca/contracts/RestakeManager.sol#L491

Vulnerability details

Impact

User is possible to get less tokens than expected when depositing to the RestakeManager contract.

Proof of Concept

function deposit in RestakeManager is to deposit collateral token to the contract and mint ezETH token to the user. The deposit function doesn't have slippage protection, so the user can get less tokens than expected.

... 
     uint256 ezETHToMint = renzoOracle.calculateMintAmount(
            totalTVL,
            collateralTokenValue,
            ezETH.totalSupply()
        );

        // Mint the ezETH
        ezETH.mint(msg.sender, ezETHToMint);

Tools Used

manual

Recommended Mitigation Steps

add slippage protection to the deposit function. user should be able to set min amount of ezETH to mint when depositing to the contract.

Assessed type

Invalid Validation