Closed code423n4 closed 1 year ago
0xSorryNotSorry marked the issue as primary issue
Seems like a misunderstanding of the protocol. There is no assumption of LSTs being 1-to-1.
Sidu28 marked the issue as sponsor disputed
GalloDaSballo marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-04-eigenlayer/blob/5e4872358cd2bda1936c29f460ece2308af4def6/src/contracts/core/StrategyManager.sol#L164-L173
Vulnerability details
Impact
The price of ETH staking derivatives may not be pegged 1-1 to ETH which affect staking conditions.
Proof of Concept
To stake eth, a user calls depositBeaconChainETH(). The amount parameter is passed into the _addShares function. In _addShares, the amount parameter is switched to shares. delegation.increaseDelegatedShares is called, which calls _delegationReceivedHook and transfers the ETH. Since amount is converted to shares, this assumes that all liquid staking derivatives have the same price, which is not true.
Tools Used
Manual Review
Recommended Mitigation Steps
Use a price oracle to approximate the rate for converting staked derivatives to ETH or simply use ETH.
Assessed type
Other