frxETH off-peg handling

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/frxETHMinter.sol#L78

Vulnerability details

Impact

There is no guarantee that the validators will not lose fund. There are multiple pitfalls can result in loss, according to Ethereum document: penalties could come from slashing, inactivity leak, reference. Or even unexpected bugs can cause loss to the validators, such as this news:
Seventy-five Eth2 validators got slashed this week due to a bug witnessed by Staked.

If some validators did incur losses, or lots of the validators suffer loss due to some softwares bugs, the equity of the frxETH holders could be less than what they have deposited. Then the booking value of the frxETH can not support the 1:1 peg, off-peg could be triggered, the consequence might go out of control. Because at the same time, the multisig is still sending staking rewards ETH to the frxETH contract to mint with hardcoded 1:1 exchange ratio. For the sfrxETH holders, what they receive is much over valued. To stop loss, they will tend to exit as soon as possible. If this scenario happens, it is expected to have large scale withdraw() of the vault, followed by panic sell off, and eventually even further depreciation of frxETH and market collapse.

If the vault was withdraw() to empty, the potential issue of ERC4626 vault exchange rate manipulation could also happen, further harm the vault and other users.

This issue is deemed as High because once it happens, the impacts might be catastrophic to the protocol.

Proof of Concept

The exchange rate of frxETH to ETH is hardcoded. During off-peg period, the incorrect ratio could enhance the market tumble.

// src/frxETHMinter.sol
    function submitAndDeposit(address recipient) external payable returns (uint256 shares) {
        // ...
        uint256 sfrxeth_recieved = sfrxETHToken.deposit(msg.value, recipient);
        // ...
    }

Tools Used

Manual analysis.

Recommended Mitigation Steps

• monitor the under-performed validators and stop loss timely.
• maybe change the hardcoded frxETH to ETH exchange ratio, and allow for some variation. Then market trades might help to stabilize the price.
• buy insurance as downside protection for off-peg, for potential large scale validator loss. Otherwise, no base booking value could result in disastrous results like UST/luna.

[FortisFortuna]

From @denett
Nobody will mint frxETH at 1-1 when the peg is off, they will just buy on Curve. After unlocks we will use the ETH to buy back frxETH from the market. If a huge slashing event happend and we will only have 0.80 ETH per frxETH the frxETH price will be below 0.8 ETH on Curve, so we will then also buy back below the peg.
We can chose to restore the peg by migrating the frxETH token to frxETHv2 that is pegged 1-1 to ETH again.

[0xean]

dupe of #113