code-423n4 / 2023-05-asymmetry-mitigation-contest

Asymmetry - Mitigation Review contest details

• Total Prize Pool: $15,000 USDC
• Warden guidelines for C4 mitigation reviews
• Submit findings using the C4 form
• Starts May 4, 2023 20:00 UTC
• Ends May 8, 2023 20:00 UTC

Important note

Each warden must submit a mitigation review for every in-scope High and Medium finding from the parent contest. Incomplete mitigation reviews will not be eligible for awards.

Findings being mitigated

Mitigations of all High and Medium issues will be considered in-scope and listed here.

• H-01: An attacker can manipulate the preDepositvePrice to steal from other users.

• H-02: A temporary issue shows in the staking functionality which leads to the users receiving less minted tokens.

• H-03: Users can fail to unstake and lose their deserved ETH because malfunctioning or untrusted derivative cannot be removed.

• H-04: Price of sfrxEth derivative is calculated incorrectly.

• H-05: Reth poolPrice calculation may overflow.

• H-06: WstEth derivative assumes a ~1=1 peg of stETH to ETH.

• H-07: Reth.sol: Withdrawals are unreliable and depend on excess RocketDepositPool balance which can brick the whole protocol.

• H-08: Staking, unstaking and rebalanceToWeight can be sandwiched (Mainly rETH deposit).

• M-01: Division before multiplication truncate minOut and incurs heavy precision loss and result in insufficient slippage protection

• M-02: sFrxEth may revert on redeeming non-zero amount

• M-04: Lack of deadline for uniswap AMM

• M-05: Missing derivative limit and deposit availability checks will revert the whole stake() function

• M-08: Possible DoS on unstake()

• M-09: Non-ideal rETH/WETH pool used pays unnecessary fees

• M-10: Stuck ether when use function stake with empty derivatives(derivativeCount = 0)

• M-11: Residual ETH unreachable and unuitilized in SafEth.sol

• M-12: No slippage protection on stake() in SafEth.sol

Overview of changes

Most of the mitigations I feel are self explanatory.

The one exception is H-04, I would like extra attention towards that one because we are assuming 1:1 but are reverting if the CRV pool is depegged. I think there could be a better solution, but it seems that we had many issues that had separate solutions, one being adding a chainlink oracle, which doesn't exist.

Mitigations to be reviewed

URL	Mitigation of	Purpose
https://github.com/asymmetryfinance/smart-contracts/pull/282/files	H-01	Use internal accounting to get the balance
https://github.com/asymmetryfinance/smart-contracts/pull/209/files	H-02	Don't get rETH from pool on deposits
https://github.com/asymmetryfinance/smart-contracts/pull/264/files	H-03	Enable/Disable Derivatives
https://github.com/asymmetryfinance/smart-contracts/pull/262/files	H-04	To protect against oracle attacks we assume FRX is 1:1 with ETH and revert if the oracle says otherwise since there is no chainlink for FRX
https://github.com/asymmetryfinance/smart-contracts/pull/209/files	H-05	Using Chainlink to get price instead of poolPrice
https://github.com/asymmetryfinance/smart-contracts/pull/242/files	H-06	Using Chainlink to get price instead of assuming 1:1
https://github.com/asymmetryfinance/smart-contracts/pull/258/files	H-07	Check if withdraw from deposit contract possible
https://github.com/asymmetryfinance/smart-contracts/pull/209/files	H-08	Using Chainlink to get price instead of poolPrice
https://github.com/asymmetryfinance/smart-contracts/pull/276/files	M-01	Don't divide before multiply
https://github.com/asymmetryfinance/smart-contracts/pull/264/files	M-02	Fixing it by enable/disable derivatives
https://github.com/asymmetryfinance/smart-contracts/pull/228/files	M-04	Using swapTo/swapFrom directly from rocketpool
https://github.com/asymmetryfinance/smart-contracts/pull/264/files	M-05	Fixing it by enable/disable derivatives
https://github.com/asymmetryfinance/smart-contracts/pull/209/files	M-08	Use Chainlink to get rETH
https://github.com/asymmetryfinance/smart-contracts/pull/208/files	M-10	Check derivativeCount on stake
asymmetryfinance/safeth#226	M-11	Use entire balance for rebalance
https://github.com/asymmetryfinance/smart-contracts/pull/252/files	M-12	Pass in minAmount

Out of Scope

Reason	Issue
We will be manually holding safETH to prevent this, if not redeploy	M-03
This is as expected	M-06
Will need a black swan event to happen and will upgrade rebalanceToWeights later to handle this	M-07