First Flight #22: Steaking

Description:

The contract is susceptible to a first depositor attack, which occurs when an attacker sends the WETH token directly to the wethSteakVault contract thus receiving an unfair advantage due to an imbalance in the initial distribution of shares since the exchange rate of WETH to the share token is 1:1. In this case, the first depositor(attacker) can receive more shares than they are entitled to, resulting in an unequal distribution of the pools value.

Impact:

This vulnerability allows the first depositor(attacker) to gain an unfair portion of the total shares relative to their deposit, effectively diluting the shares of subsequent depositors. Over time, this can lead to significant imbalances in asset distribution, where early participants disproportionately benefit at the expense of later depositors, undermining the integrity and fairness of the staking process.

Proof of Concept:

1. A user who staked 0.5 ether into the steaking contract. After the 4 week period, their staked ETH gets deposited into the wethSteakVault.

2. The attacker frontruns the user transaction by transferring 0.6 ether directly to the wethSteakVault which shall make the attacker increase the total balance of the pool, while maintaining the number of shares in circulation.

3. By the time the user 0.5 ether makes it to the vault, the calculation of their share ends up being zero due to the way pool shares are calculated with the total share balance.

The following is the share calculation right after the attacker first depositor attack;

amountOfDeposit * totalSupplyOfVault / balanceOfDeposit.

amountOfDeposit - How much a user is going to deposit.
totalSupplyOfVault - total Supply of Vault tokens.
balanceOfDeposit - vault's balance of deposit tokens.

The user shares would be calculated as follows;

(0.5 * 0.6) / 0.6 == 0.3 / 0.6

Which is going to result to 0.5.

There are no floating numbers in Solidity. So therefore the division is going to be rounded down to 0

The attack is fully demonstrated in the code below;

Here are the logs that were shown:

In the assertion section. We can see that the exchange rate of the WETH and share token of the wethSteakVault had been altered due to the first depositor attack. Instead of the user getting the share token worth 0.5 of the share token. The user shares get rounded down to zero.

Recommended Mitigation:

Keeping track of total assets internally - This strategy aims to negate the effect of direct transfers by keeping track of the assets held by the vault internally. This means that donated tokens are not accounted for, which effectively eliminates the risk of inflation attacks.