Rewards from native restaking kept in the DelayedWithdrawalRouter are not accounted for in calculateTVLs

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/RestakeManager.sol#L274
https://github.com/Layr-Labs/eigenlayer-contracts/blob/dev/src/contracts/pods/EigenPod.sol#L274

Vulnerability details

Impact

Users rewards from native stake are in the DelayedWithdrawalRouter and wil lbe claimed later, leading to incorrect TVL and allowing users to easily frontrun tvl updates and profit.

Proof of Concept

RestakeManager::calculateTVLs() does not take into account ETH in the DelayedWithdrawalRouter, which will happen every time a ETH withdrawal is executed in OperatorDelegator::completeQueuedWithdrawal(). In this function, the rewards from native staking will be sent to the DelayedWithdrawalRouter, where they will be kept until they are claimed and sent to the OperatorDelegator, where they are correctly accounted for. Thus, in the meantime users can buy ezETH cheaper than intended and sellers will take a loss.

Tools Used

Vscode

Recommended Mitigation Steps

Include the balance of the DelayedWithdrawalRouter in the calculation of the total TVL.

Assessed type

Other

[c4-judge]

alcueca marked the issue as duplicate of #528

[c4-judge]

alcueca marked the issue as unsatisfactory:
Invalid

[Simao123133]

This was incorrectly marked invalid, an explanation was already given in the main issue.

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[alcueca]

Pending on sponsor review and actual proof of impact being higher than dust.