Renzo - ustazz's results

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/519e518f2d8dec9acf6482b84a181e403070d22d/contracts/RestakeManager.sol#L317-L320

Vulnerability details

Impact

The potential consequences of this issue may lead to inaccuracies in the calculation performed by the RestakeManager::calculateTVLs() function. This, in turn, could affect the following:

• User deposits within the RestakeManager::deposit() and RestakeManager::depositETH() functions, as well as reward computations in RestakeManager::depositTokenRewardsFromProtocol().
• The precision of the current rate of ezETH obtained from BalancerRateProvider::getRate().
• The precision of withdrawals executed via WithdrawQueue::withdraw(), i.e. loss of funds to either user and/or protocol

Proof of Concept

In RestakeManager.sol, Line 298 and 299 define the index variable and condition for iteration

            uint256 tokenLength = collateralTokens.length;
            for (uint256 j = 0; j < tokenLength; ) {

but in line 318 different (inaccurate) index variable is used which is from outer for-loop

     collateralTokens[i],

Additionally, code block supposed to run once (due to withdrawQueueTokenBalanceRecorded initialization and update), which may result i = 0 (i.e. no error), but in calculation of totalWithdrawalQueueValue it will iterate through different balances of collateralTokens for one collateralTokens at index i.

totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(
                             collateralTokens[i],
                             collateralTokens[j].balanceOf(withdrawQueue)
                        );

Tools Used

Manual analysis

Recommended Mitigation Steps

Change the index variable from i to j in line 318 in RestakeManager.sol

    totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(
-                            collateralTokens[i],
+                            collateralTokens[j],
                             collateralTokens[j].balanceOf(withdrawQueue)
                        );

Assessed type

Context