Zaros Part 1

Summary

WSTETH and WEETH prices can not be computed properly with the current implementation on Arbitrum chain

Vulnerability Details

Currently the computation for every supported token in the protocol is done via a simple Chainlink price feed fetch. However, for WSTETH and WEETH it does not exist a price feed paired with USD, so it is not possible to compute their price with a single fetch to a price feed.

There are 2 proper ways to compute the price of WSTETH in terms of USD:

1. Get the price of STETH via the STETH/USD price feed and then multiply it by the exchange rate fetched from the WSTETH/STETH price feed

2. Get the WSTETH price in terms of ETH with the WSTETH/ETH price feed and then multiply it by the price of ETH in terms of USD using the ETH/USD price feed

For WEETH, the only way to compute its price is by getting the price of WEETH in terms of ETH with the WEETH/ETH price feed and then multiply it by the price of ETH in terms of USD using the ETH/USD price feed

As exposed, these 2 assets currently require 2 different price feed fetches in order to compute its price in terms of USD, so it will not be possible to be computed with the current implementation that only fetches a price from a single price feed.

Impact

These 2 assets will not be possible to be used. Or if they are used will only fetch a single price feed they will return a wrong price.

Tools Used

Manual review

Recommendations

Create custom price computation for assets that require more than a single price feed fetch