# CBEthCollateral and AnkrStakedEthCollateral \_underlyingRefPerTok is incorrect

cbETH/ankrETH collateral plugins used exchangeRate (cbETH→staked ETH2) as ref/tok, overvaluing collateral vs ETH and letting attackers mint excess rtokens.

- Payout: Contest reward
- Severity: high
- Program: Reserve
- Credited: ronnyx2017
- Disclosed: 2023-11-13
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/23
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** CBEthCollateral / AnkrStakedEthCollateral asset plugins (_underlyingRefPerTok)
**Root cause:** The ref unit is defined as ETH, but _underlyingRefPerTok returns CBEth.exchangeRate() which is cbETH→staked ETH2, ignoring the ETH/staked-ETH2 premium from unstake delay and flash-unstake fees.
**Steps:**
1. Read CBEthCollateral._underlyingRefPerTok at CBETHCollateral.sol#L67-L69: returns CBEth.exchangeRate().
2. Compare CBEth.exchangeRate() (1.045264058480813188 at block ~17819370) with Chainlink cbETH/ETH feed (1.0438).
3. Observe exchangeRate overstates cbETH value in ETH terms by the staking premium.
4. Attacker mints rtokens against cbETH collateral valued at the inflated rate, extracting the premium.
**How found:** Code-reading of the collateral plugin against its README ref-unit definition (ref = ETH), noticing exchangeRate() returns cbETH/staked-ETH2 not cbETH/ETH; confirmed by comparing on-chain exchangeRate to the Chainlink cbETH/ETH price.
**Exploitation:** When the ETH2 unstake queue grows, the cbETH/ETH premium widens; attacker deposits cbETH valued via exchangeRate to mint more rtokens than the collateral is worth in ETH, then redeems/exits capturing the difference. Also, if cbETH defaults, collateral never marks DISABLED since exchangeRate only tracks cbETH/staked-ETH2.
**Insight:** When a plugin's ref unit is a different asset than the oracle's quote unit (ETH vs staked ETH2), the exchange rate silently embeds a premium/fee; always verify the oracle's denominator matches the documented ref unit, especially for LSDs with unstake queues.