Core idea is to peg zETH to ETH. However on deposit/withdraw/unstake protocol treats that stETH is equal to ETH.
In this chart you can see that price deviates. As a result depeg of stETH will cause depeg of zETH
Let's take for example deposit flow (but similar situation with withdraw and unstake too). Contract accepts amount
of stETH and locks it, and must return locked amount of ETH. Such that zethAmount
must be in terms of ETH, not stETH
https://github.com/Cyfrin/2023-09-ditto/blob/a93b4276420a092913f43169a353a6198d3c21b9/contracts/facets/BridgeRouterFacet.sol#L46-L65
But BridgeStEth returns amount of stETH, not ETH:
https://github.com/Cyfrin/2023-09-ditto/blob/a93b4276420a092913f43169a353a6198d3c21b9/contracts/bridges/BridgeSteth.sol#L58-L68
Deviation of stETH can cause depeg of zETH
Manual Review
Firstly convert ETH amount to stETH via Chainlink price feed. Add this logic to functions deposit()
, depositEth()
, withdraw()
, unstake()
. And also in function getZethVaule()
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.