Submitted by ronnyx2017, also found by ayeslick and rvierdiiev
https://github.com/code-423n4/2022-09-frax/blob/main/src/frxETHMinter.sol#L166-L174
https://github.com/code-423n4/2022-09-frax/blob/main/src/frxETHMinter.sol#L191-L196
https://github.com/code-423n4/2022-09-frax/blob/main/src/frxETHMinter.sol#L114-L116
It will lead to duplicating accounting for the Eths which have been already converted to the frxETH tokens. It means Eth:frxEth will not be 1:1, and eventually leads to decoupling.
The function moveWithheldETH will send the amount of the Withheld ETH in the contract to the address to. It doesnt check if the to address is the frxETHMinter contract itself.
And the frxETHMinter has the receive function which will submit any eth received to the frxETH.
But these parts of Eths (WithheldETH) also have been converted to the frxETH normally when they were sent to the contract at the first time.
So these Eths will be accounted, Twice, even more. It means Eth:frxEth will not be 1:1 anymore.
The function recoverEther has the same problem. Although these two functions can only be called by owner or DAO gov. It seriously affects financial stability.
Furthermore, due to the logic receive() -> submit(), any kind of transaction that withdraws ETH from the contract and then sends it back will cause the same problem.
A non-feedback paybale empty function that does not use _submit() should be added to receive special ETH without increasing the frxeth supply.
FortisFortuna (Frax) commented:
0xean (judge) commented:
