DittoETH

Summary

zETH is a token that represents a basket of liquid staking tokens, including stETH. People who hold stETH receive LDO governance tokens (tokens that have value and give governance rights with respect to the Lido protocol that issues stETH). Ditto's smart contracts do not have code to either distribute LDO to the people who hold zETH or for the LDO to be claimed by the Ditto protocol.

Vulnerability Details

There is an absence of code or plans to distribute the LDO tokens in the smart contracts or in the documentation.

Impact

In many protocols that accept tokens that collect rewards, these rewards are distributed to the people who deposit in the protocol. See, eg, the fact that Convex distributed EPS rewards to people who deposited CRV on their platform (EPS was a token similar to CRV issued by Ellipsis on the Binance Smart Chain to holders of veCRV). People may be dissuaded from depositing on Ditto if they know they won't get their LDO. It reduces their overall return on their LST - they may choose to deposit on a similar platform that does issue them their LDO. It is important to getting this platform off the ground that you attract as much capital as possible.

Also, the documentation should address this no matter who ends up keeping the LDO.

Tools Used

Manual review

Recommendations

I would recommend that you distribute these tokens as additional rewards to all people who hold zETH. This also attracts more capital to your platform than if you keep the LDO tokens for the protocol or if nothing is done with them at all (which is currently the way this is set up and the worst option since no one benefits). Another creative option would be to sell them for Ditto that you issue to zETH holders as additional Ditto rewards, which would prop up the market for Ditto by creating buy pressure.