# The peg stability module can be compromised by forcing lowerDepeg to revert

withdraw() fails to decrement totalWethDelegated, so an attacker inflates it and sync() under-reports WETH reserves, making lowerDepeg revert and blocking peg defense.

- Payout: Contest reward
- Severity: high
- Program: Dopex
- Credited: 0xrafaelnicolau
- Disclosed: 2023-12-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/239
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-08
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** RdpxV2Core peg stability module (addToDelegate/withdraw/sync/lowerDepeg)
**Root cause:** withdraw() returns delegated WETH to the user but never decrements totalWethDelegated, so sync() subtracts an inflated delegated amount from the real WETH reserve accounting.
**Steps:**
1. Attacker calls `addToDelegate(wethReserveBefore, 1e8)` depositing WETH; totalWethDelegated increases by the deposit.
2. Attacker calls `withdraw(delegateId)`; WETH is returned but totalWethDelegated stays inflated.
3. Repeat steps 1-2 with small amounts to inflate totalWethDelegated cheaply.
4. Call `sync()`; WETH reserve is computed as reserve - totalWethDelegated, dropping to near zero.
5. Admin calls `lowerDepeg(0, 10 ether, 0, 0)` to defend the peg; it reverts with arithmetic underflow.
**How found:** Code review of the delegate accounting: noticed withdraw() transfers WETH back but omits `totalWethDelegated -= amountWithdrawn`, then traced how sync() consumes that variable and how lowerDepeg depends on the WETH reserve.
**Exploitation:** Attacker needs only a small WETH balance to loop addToDelegate/withdraw, inflating totalWethDelegated without cost. sync() then zeroes the recorded WETH reserve. When dpxETH depegs below ETH, the admin's lowerDepeg call underflows and reverts, so the protocol cannot buy/burn dpxETH to restore the peg.
**Escalation:** Looping addToDelegate/withdraw makes the attack financially inexpensive; the result is a persistent DoS on the peg stability module during depeg events.
**Insight:** When a contract tracks a 'delegated/pending' counter separately from token balances, audit every path that moves the underlying (withdraw, cancel, emergency exit) for a matching decrement; then check which critical functions consume that counter and can be DoS'd by inflating it.