DeFiFoundrySolidity
16,653 OP
View results
Submission Details
Severity: medium
Invalid

Price Divergence Lock in WETH-alETH Conversion Mechanism

Summary :

The StrategyOp contract enforces a strict premium requirement for WETH to alETH conversions, which can lead to position management failures during market stress scenarios, potentially trapping user funds and preventing automated debt repayment.

Vulnerability Details :

The contract requires that any WETH to alETH conversion must result in receiving more alETH than the WETH input (premium requirement).

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
require(minOut > _amount, "minOut too low");
IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

During market stress when WETH/alETH price ratio increases significantly:

  1. Automated conversions become impossible

  2. Yield harvesting mechanism breaks

  3. Debt repayment through yield gets blocked.

Let's say a user has:

  • Deposited 10 WETH as collateral

  • Borrowed 8 alETH against it.

Price Movement Impact:

  1. Normal Market Conditions:

  • WETH = $2000

  • alETH = $2000

  • Position Value = $20,000 collateral, $16,000 debt

  1. Market Stress Scenario:

  • WETH price rises to $2500

  • alETH stays at $2000 (or drops)

  • Now collateral = $25,000, but debt value remains $16,000

The Critical Issues:

  1. Swap Lockout:

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path ) external onlyKeepers

Impact :

As a result

  • Strategy can't swap WETH to alETH due to the premium requirement

  • Claimed WETH rewards can't be converted back to alETH

  • Debt repayment mechanism gets blocked.

  1. Compounding Effect:

    • Unconverted rewards affect total strategy value

    • Users might need to manually repay more debt

    • Higher effective borrowing costs

function _harvestAndReport() internal override returns (uint256 _totalAssets)

Tools Used

  • Manual code review

Recommendations

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.