Asymmetry Finance afETH - Mitigation Review details

• Total Prize Pool: $7,150 USDC
• Warden guidelines for C4 mitigation reviews
• Submit findings using the C4 form
• Starts October 20, 2023 20:00 UTC
• Ends October 25, 2023 20:00 UTC

Important note

Each warden must submit a mitigation review for every High and Medium finding from the parent audit that is listed as in-scope for the mitigation review. Incomplete mitigation reviews will not be eligible for awards.

Findings being mitigated

Mitigations of all High and Medium issues will be considered in-scope and listed here.

• H-01: Intrinsic arbitrage from price discrepancy
• H-02: Zero amount withdrawals of SafEth or Votium will brick the withdraw process
• H-03: AfEth deposits could use price data from an invalid Chainlink response
• H-04: price() in AfEth.sol doesn't take afEth held for pending withdrawals into account
• H-05: Functions in the VotiumStrategy contract are susceptible to sandwich attacks
• M-01: AfEth collaterals cannot be balanced after ratio is changed
• M-02: Swap functionality to sell rewards is too permissive and could cause accidental or intentional loss of value
• M-03: Forced relock in VotiumStrategy withdrawal causes denial of service if Convex locking contract is shutdown
• M-04: VotiumStrategy withdrawal queue fails to consider available unlocked tokens causing different issues in the withdraw process
• M-05: Reward sandwiching in VotiumStrategy
• M-06: Missing deadline check for AfEth actions
• M-07: Lack of access control and value validation in the reward flow exposes functions to public access
• M-08: Inflation attack in VotiumStrategy
• M-09: Missing circuit breaker checks in ethPerCvx() for Chainlink's price feed
• M-10: It might not be possible to applyRewards(), if an amount received is less than 0.05 eth

Overview of changes

Most of the changes felt relatively straight forward. The biggest change we did was not burning afEth on withdraw, instead we now burn it on requestWithdraw. This is mostly in regards to H-04, but would like to have extra care taken around that to make sure nothing is broken.

Mitigations to be reviewed

Branch

All audit mitigations

Individual PRs

Wherever possible, mitigations should be provided in separate pull requests, one per issue. If that is not possible (e.g. because several audit findings stem from the same core problem), then please link the PR to all relevant issues in your findings repo.

Out of Scope