[M-01] Inexistent slippage protection for stake/deposit

[code423n4]

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/SfrxEth.sol#L94
https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/derivatives/WstEth.sol#L73

Vulnerability details

Impact

Stake/Deposit actions do not specify any minimum accepted values. This renders users and the protocol prone to arbitrage attacks, causing them to receive less than expected value.

Proof of Concept

Using deposit() in the SfrxEth.sol contract:

// SfrxEth.sol
function deposit() external payable onlyOwner returns (uint256) {
        IFrxETHMinter frxETHMinterContract = IFrxETHMinter(
            FRX_ETH_MINTER_ADDRESS
        );
        uint256 sfrxBalancePre = IERC20(SFRX_ETH_ADDRESS).balanceOf(
            address(this)
        );
        frxETHMinterContract.submitAndDeposit{value: msg.value}(address(this));
        uint256 sfrxBalancePost = IERC20(SFRX_ETH_ADDRESS).balanceOf(
            address(this)
        );
        return sfrxBalancePost - sfrxBalancePre;
    }

If the frxETHMinterContract.submitAndDeposit returns a very low amount (due to arbitrage or error on Frax’s contract), the protocol will assume very little was deposited and mint less safETH to the user who staked.

Tools Used

Manual review

Recommended Mitigation Steps

It is advised to add a param to stake() to relay expected minimum receive values and revert if the minimum is not received. For example:

// SafEth.sol
function stake(uint256 minReceiveAmt) external payable {
...
uint256 mintAmount = (totalStakeValueEth * 10 ** 18) / preDepositPrice;
require(mintAmount >= minReceiveAmt, "less than minimum received") 
_mint(msg.sender, mintAmount);

[c4-pre-sort]

0xSorryNotSorry marked the issue as primary issue

[c4-sponsor]

toshiSat marked the issue as sponsor disputed

[c4-judge]

Picodes marked the issue as unsatisfactory:
Invalid

[c4-judge]

Picodes marked the issue as duplicate of #150

[c4-judge]

Picodes marked the issue as satisfactory