0x73696d616f - Rebasing tokens are not supported contrary to the readme and will lead to loss of funds

[sherlock-admin2]

0x73696d616f

Medium

Rebasing tokens are not supported contrary to the readme and will lead to loss of funds

Summary

The readme states that rebasing tokens are supported

Rebasing tokens are supported with exchange rate mechanism

However, only non rebasing tokens such as the wrapped version wsteth are supposed. If stETH is used, it will accrue value in the Psm and Vault (technically they are the same contract) which will be left untracked as Ra and Pa deposits are tracked in state variables.

Root Cause

The code does not handle rebasing tokens even though the readme says it does. The exchange rate mechanism only supports non rebasing tokens such as wsteth.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

Admin creates steth pairs using it as Ra or Pa, whose value will grow in the protocol but left untracked as the quantites are tracked with state variables.

Impact

Stuck yield accruel in the Vault/Psm contracts.

PoC

State.sol tracks the balances:

struct Balances {
    PsmRedemptionAssetManager ra;
    uint256 dsBalance;
    uint256 ctBalance;
    uint256 paBalance;
}

Mitigation

Don't set rebasing tokens are Ra or Pa or implement a way to sync the balances.

[ziankork]

this is intended as there's no easy way to sync balance between psm and vault since when we sync we have to somehow calculate the virtual reserves of each PSM and Vault from the total shares that the contract holds. so won't fix