DittoETH

Summary

In the case of a negative yield event, when 1 zETH < 1 ETH, new depositors will take on a loss favoring the previous depositors.

Vulnerability Details

Take this example:

1. Bob deposited 100 ETH and got 100 zETH.

2. On one of the staking vaults there was a negative yield event, and the 100 zETH are worth 90 ETH.

3. Alice comes and deposits 100 ETH and gets 100 zETH.

4. Alice withdraws her 100 zETH and gets 95 ETH.

In this case Alice shared the loss with Bob, even though she had not deposited when the negative yield event happened.

Impact

In the case of 1 zETH < 1 ETH new depositors will take on a loss favoring the previous depositors.

Recommendations

The BridgeRouterFacet._ethConversion() is used for withdraws to see how many ETH the user is owed for their zETH, and if 1 zETH < 1 ETH the _ethConversion() should also be calculated to give more zETH to the depositor, equivalent to the ETH deposited at the current rate.