Asymmetry Finance afETH - Mitigation Review

The aggregation and optimization layer for Liquid Staking Tokens.

  • Start date20 Oct 2023
  • End date25 Oct 2023
  • Total awards$7,150 USDC
  • Duration5 days

Asymmetry Finance afETH - Mitigation Review details

Important note

Each warden must submit a mitigation review for every High and Medium finding from the parent audit that is listed as in-scope for the mitigation review. Incomplete mitigation reviews will not be eligible for awards.

Findings being mitigated

Mitigations of all High and Medium issues will be considered in-scope and listed here.

Overview of changes

Most of the changes felt relatively straight forward. The biggest change we did was not burning afEth on withdraw, instead we now burn it on requestWithdraw. This is mostly in regards to H-04, but would like to have extra care taken around that to make sure nothing is broken.

Mitigations to be reviewed

Branch

All audit mitigations

Individual PRs

Wherever possible, mitigations should be provided in separate pull requests, one per issue. If that is not possible (e.g. because several audit findings stem from the same core problem), then please link the PR to all relevant issues in your findings repo.

URLMitigation ofPurpose
https://github.com/code-423n4/2023-09-asymmetry-findings/issues/62H-01After days of research we decided that this was acceptable. Check the link to view our response.
https://github.com/asymmetryfinance/afeth/pull/159H-02Don't withdraw zero from SafEth or Votium
https://github.com/asymmetryfinance/afeth/pull/165H-03Validate Chainlink price data
https://github.com/asymmetryfinance/afeth/pull/162 & https://github.com/asymmetryfinance/afeth/pull/172H-04For this one we made afEth just burn on requestWithdraw
https://github.com/asymmetryfinance/afeth/pull/176 & https://github.com/asymmetryfinance/afeth/pull/178 & https://github.com/asymmetryfinance/afeth/pull/169H-05For this one we locked down the depositRewards function and added a minout to the reward functions
https://github.com/asymmetryfinance/afeth/pull/164M-03Check if vlcvx contract is shutdown before trying to relock
https://github.com/asymmetryfinance/afeth/pull/168M-04Check if available amount to withdraw is already in contract
https://github.com/asymmetryfinance/afeth/pull/168M-05Add a minimum epoch of 1 to not allow users to immediately withdraw
https://github.com/asymmetryfinance/afeth/pull/175M-06Add a deadline check for deposit & withdraw
https://github.com/asymmetryfinance/afeth/pull/193 & https://github.com/asymmetryfinance/afeth/pull/190M-07Here we did two things, check msg.value instead of passing in amount & make deposit rewards private
https://github.com/asymmetryfinance/afeth/pull/179M-08Track balances instead of using balanceOf
https://github.com/code-423n4/2023-09-asymmetry-findings/issues/16M-10No code changes needed, we removed the minimum stake amount from SafEth

Out of Scope

URLMitigation ofPurpose
https://github.com/code-423n4/2023-09-asymmetry-findings/issues/55M-01Acknowledged and did not fix, plan to upgrade a fix in the future
https://github.com/code-423n4/2023-09-asymmetry-findings/issues/54M-02Did not fix, should have been marked acknowledged
https://github.com/code-423n4/2023-09-asymmetry-findings/issues/31M-09Didn't fix, should have been marked acknowledged