M-12 MitigationConfirmed

[c4-bot-3]

Lines of code

Vulnerability details

The fix applied by the team fully mitigates M-12, but introduces a new issue.

[alcueca]

The mitigation review should include more than just links to the issue and the fix. Not much is needed, but at least a description of both.

[c4-judge]

alcueca marked the issue as unsatisfactory:
Insufficient quality

[s1n1st3r01]

Original vulnerability

---

The xRenzoDeposit contract acts as a rate provider for Balancer pools on L2s, allowing them to determine the correct exchange rate between xezETH and WETH tokens.

The issue is that the getRate() function is providing an inaccurate exchange rate. It simply returns the lastPrice state variable which can be stale if, for example, updatePrice() has not been called recently. It can also be stale if it's older than the rate provided by the oracle through oracle.getMintRate().

    function getRate() external view override returns (uint256) {
        return lastPrice;
    }

Providing a stale exchange rate can cause the balancer pools to misprice xezETH relative to WETH and therefore enable manipulation of pool joins and exits.

Mitigation Analysis

---

The mitigation fixes the original issue effectively by relying on the getMintRate() function to provide a correct _lastPrice. The getMintRate() function is responsible for returning the rate used to mint xezETH.

-        (uint256 _lastPrice, ) = getMintRate();
+        (uint256 _lastPrice, uint256 _lastPriceTimestamp) = getMintRate();
+        if (block.timestamp > _lastPriceTimestamp + 1 days) {
+            revert OraclePriceExpired();
+        }

Notes

---

While the mitigation proposed effectively fixes the original issue (returning of the incorrect exchange) rate, it also introduces a new potential issue discussed in great detail here

[c4-judge]

alcueca marked the issue as satisfactory