MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Improper WStETH contract implementation

praise03

Summary

stETH wrapper token is poorly implemented which opens up the system to a number of attacks.

Vulnerability Details

The mint function in the wstETH contract allows address to mint an unlimited number of tokens as shown below

function testCanMintAnyNumberOfWSTETH() public {
vm.prank(address(2));
wstETHMock.mint(msg.sender, 1000e18);
}

Also the contract implements a wrap function to convert stETH to wstETH but fails to offer an unwrap function for converting wrapped tokens back to the underlying token

Impact

Users can mint any amount of tokens at will and it is impossible to get back ones deposited token from the wrapper contract

Tools Used

Manual Review

Recommendations

Consider Implementing an unwrap function for converting wstETH to stETH and also proper guards and validation should be implemented in the wstETH mint function

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of access control in `StETHMock:mint` and `WStETHMock::mint`

Lack of an unwrap method in WStETHMock.sol leads to funds stuck as WstETHMock

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of access control in `StETHMock:mint` and `WStETHMock::mint`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.