infect3d - Mellow assume 1 stETH == 1 WETH which open-up opportunities for arbitrage

[sherlock-admin3]

infect3d

Medium

Mellow assume 1 stETH == 1 WETH which open-up opportunities for arbitrage

Summary

Because stETH price fluctuate compared to WETH price, wstETH:ETH pricing based on solely wstETH:stETH exchange rate is innacurate.

Vulnerability Detail

https://dune.com/LidoAnalytical/Curve-ETHstETH
https://dune.com/queries/3852516/6479636

Because stETH is the result of staked ETH, depending on market and technical conditions, its demand can vary and its price fluctuate compared to ETH as shown by this Dune dashboard.

This means people can buy stETH on the market at discount (stETH:ETH <1), and deposit into the vault at the value of stETH:ETH ==1, the result is shares minted as if they deposited more stETH that they actually did.

If we look the stETH:ETH exchange rate at a higher timescale, we can see that there has been times where stETH was trading well bellow 1:1, giving users plenty of time to deposit into the protocol, and wait for price getting more healthy and request a withdraw.

Impact

User will be able to mint vault shares at discount during depeg events, and withdraw when market get healthier to make profit off other users who deposited during healthy periods.

Code Snippet

This is the oracle used for wstETH : https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/oracles/WStethRatiosAggregatorV3.sol#L9-L9

File: src/oracles/WStethRatiosAggregatorV3.sol
07: contract WStethRatiosAggregatorV3 is IAggregatorV3 {
08:     uint8 public constant decimals = 18;
09:     address public immutable wsteth;
10: 
11:     constructor(address wsteth_) {
12:         wsteth = wsteth_;
13:     }
14: 
15:     function getAnswer() public view returns (int256) {
16:⚠		return int256(IWSteth(wsteth).getStETHByWstETH(10 ** decimals));
17:     }
18: 
19:     function latestRoundData()
20:         public
21:         view
22:         override
23:         returns (uint80, int256, uint256, uint256, uint80)
24:     {
25:         return (0, getAnswer(), block.timestamp, block.timestamp, 0);
26:     }
27: }

Tool used

Manual review

Recommendation

Use the existing StETH:ETH Chainlink price feed to complete the pricing chain and get an accurate value of wstETH to ETH.

Duplicate of #266