weETH and WSTETH do not have usd price feeds but have ETH ones
Summary
weETH and WSTETH do not have Chainlink USD price feeds on Arbitrum. Instead they have ETH ones. Their USD price can be calculated but such logic is missing and they will not be able to be supported despite being in scope.
Vulnerability Details
Chainlink Price Feed for WSTETH / ETH - link
Chainlink Price Feed for weETH / ETH - link
As we can see 1 WSTETH or 1 weETH do not equal 1 ETH so assuming that the ETH / USD price feed would do the job this is not the case.
At the time of writing this report 1 WSTETH == 1.1736 ETH and 1 weETH == 1.0438 ETH.
In order for the protocol to support these tokens they should implement additional logic that fetches the ETH / USD price and then fetches either the WSTETH / ETH or weETH / ETH price. Once the protocol knows how much ETH is 1 WSTETH and how much USD is 1 ETH it will be easy to determine the price of the asset in USD.
There could be a list of assets that have a ETH price feed instead of a USD one for which this logic would be applied.
Impact
With the current implementation weETH and WSTETH are not supported despite being in scope.
Tools Used
Manual Review
Recommended Mitigation
Implement the logic that was described above.
Lead Judging Commences
Some in-scope tokens don't have Chainlink feeds on Arbi
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.