Submission Details
Severity:
Incorrect Conversion Rate
Summary
The deposit/withdrawal conversion rate does not properly account for negative yields.
Vulnerability Details
When yield is negative, deposit and withdraw incorrectly assume 1 rETH = 1 ETH. This could allow withdrawing more ETH than deposited.
For example:
function deposit(uint rETH) external returns (uint zETH) {
// Incorrect, doesn't consider negative yield
return rETH;
}
function withdraw(uint zETH) external returns (uint rETH) {
// Incorrect, doesn't consider negative yield
return zETH;
}
## Impact
Possibility to arbitrage and exploit negative yields.
## Tools Used
Manual
## Recommendations
Properly account for yield rates in the deposit/withdrawal exchange rate.
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.