-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
X12 - WStethRatiosAggregatorV3 will not work properly if the base token is anything but stETH #29
Comments
Edit: Ignore this comment |
I think the above comment by @z3s is due to my report . I believe my report is under the name "Angry_Mustache_Man" has been wrongly duped with these set of issues . I don't know whether this family of issues are completely correct or not ,but the issue #228 I have submitted is wrong and for it the above comment by @z3s is valid . |
protocol in discord |
X12
Medium
WStethRatiosAggregatorV3 will not work properly if the base token is anything but stETH
Summary
Vaults have impermanent loss because they rely on the current price.
Vulnerability Detail
The initial base token for our system is WETH, as seen here.
With that in mind, when we extract the price from WStethRatiosAggregatorV3, our latestRoundData will return
IWSteth(wsteth).getStETHByWstETH
, which is the price ofwstETH
instETH
terms based on Lido's docs.However,
WETH : stETH
can have small price differences (i.e., it's not1 : 1
), and the ratio ofwstETH
instETH
will result in slight price differences when used with our base token -WETH
. This will cause the real price ofwstETH
to be over or undervalued, resulting in users depositing fewer or more shares than they should.Note that even if the base token is something else (other than
stETH
), the same issue will appear.Impact
Slight price differences can cause inaccurate share allocations.
Code Snippet
Tool used
Manual Review
Recommendation
Have WStethRatiosAggregatorV3 perform another conversion for
stETH
to the base token and use that price.Duplicate of #266
The text was updated successfully, but these errors were encountered: