DittoETH

Ditto
DeFiFoundryOracle
55,000 USDC
View results
Submission Details
Severity: low
Valid

BridgeReth unstake() function can be unavailable because of not enough ETH in RocketDepositPool

Summary

The BridgeReth unstake() function can become unavailable, because it depends on the RocketDepositPool having enough ETH to cover the unstake.

Vulnerability Details

As per the rocketpool documentation:
Trading rETH back for ETH is only possible when the staking liquidity pool has enough ETH in it to handle your trade. This is Rocket Pool's pool of ETH that comes from two sources:

  • ETH that other stakers have deposited, which hasn't been used by a Node Operator to create a new validator yet

  • ETH that was returned by a Node Operator after they exited one of their validators and received their rewards from the Beacon Chain

Impact

In the case that RocketDepositPool does not have enough ETH to cover the unstake, the impact is minimal since a user could use the function withdraw(), and wait to do the unstake later at the rocket pool website or directly in the contract RocketTokenRETH.sol when enough ETH is available or in alternative a user could also swap the rETH for ETH at a decentralized exchange like Uniswap likely for the cost of a small premium.

Recommendations

Let users know that if that in the case the unstake() function is unavailable, they could try later or withdraw() and unstake later at the rocket pool contract

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-503

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.