# Staking, unstaking and rebalanceToWeight can be sandwiched (Mainly rETH deposit)

SafEth's rETH derivative swaps user deposits on Uniswap spot price with only 1% slippage, letting an attacker sandwich each stake for profit.

- Payout: Contest reward
- Severity: high
- Program: Asymmetry Finance
- Credited: HHK
- Disclosed: 2023-07-28
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-03-asymmetry-findings/issues/142
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** SafEth staking contract / Reth derivative Uniswap swap
**Root cause:** When the RocketPool deposit contract is closed, Reth.sol swaps ETH for rETH at the Uniswap pool spot price and derives minOut from that same spot price with a 1% maxSlippage, so the swap is fully sandwichable.
**Steps:**
1. Attacker front-runs: swap 100 ETH into the rETH/ETH pool, moving price (pool 10000 rETH / 10695 ETH -> 9907.36 rETH / 10795 ETH).
2. Victim calls stake() with 100 ETH; ~33.33 ETH routed to Reth derivative, which computes minOut = 33.3333 * 0.9177 * 0.99 = 30.284 rETH from current spot.
3. Contract swaps 33.3333 ETH for 30.498 rETH (0.61% slippage, under 1% cap), pool -> 9876.86 rETH / 10828.33 ETH.
4. Attacker back-runs: swap 92.63 rETH back for ~100.61 ETH, netting ~0.61 ETH profit; can push slippage up to the 1% maxSlippage.
**How found:** Code reading of Reth.sol: noticed the deposit path falls back to a Uniswap swap using pool spot price when the RocketPool deposit contract is closed, and that minOut is computed from that same spot price, making the swap sandwichable within maxSlippage.
**Exploitation:** Classic sandwich: front-run swap to skew the Uniswap rETH/ETH spot price, let the victim's stake() execute the derivative swap at the manipulated price within the 1% maxSlippage tolerance, then back-run to restore the pool and capture the difference. Profit scales with victim size and the maxSlippage cap; concentrated Uniswap v3 liquidity allows draining one side and adding liquidity in a tight range.
**Escalation:** Attacker can maximize extraction up to the 1% maxSlippage; on Uniswap v3 concentrated liquidity, adding liquidity in a tight range and draining one side amplifies the manipulation.
**Insight:** When a contract derives its own slippage floor from the same AMM spot price it trades against, the check is circular and offers no protection; look for minOut computed from pool reserves rather than an external oracle/TWAP.