Submitted by LessDupes, also found by Bauchibred
The xRenzoDeposit contract, apart from being the entry point for deposits on L2s, also acts as a rate provider for Balancer pools on L2s, allowing them to determine the exchange rate between xezWETH and WETH tokens. Rate providers are crucial for Balancer pools to calculate token prices and determine yield protocol fees during joins and exits, as explained in the Balancer documentation.
However, the getRate() function in xRenzoDeposit does not provide the correct exchange rate. It simply returns the lastPrice state variable, which:
By providing an incorrect and potentially outdated exchange rate, xRenzoDeposit can cause Balancer pools to misprice xezWETH relative to WETH. This can lead to incorrect yield calculations and enable manipulation of pool joins and exits.
Update the getRate() function to provide the same exchange rate used when minting xezETH. This can be achieved by calling getMintRate() instead of returning lastPrice directly:
This ensures that the rate provided to Balancer pools is consistent with the actual minting rate and is not stale.
jatinj615 (Renzo) confirmed
Renzo mitigated:
Status: Mitigation confirmed. Full details in reports from 0xCiphky, grearlake, Fassi_Security, LessDupes, and Bauchibred.
