# Intrinsic arbitrage from price discrepancy

AfEth mints shares using oracle-estimated prices while deposits trade at true prices, letting users deposit then immediately withdraw for profit when prices deviate up to 2%.

- Payout: Contest reward
- Severity: high
- Program: Asymmetry Finance
- Credited: d3e4
- Disclosed: 2024-02-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/62
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** AfEth vault deposit/withdraw accounting (VotiumStrategy Chainlink pricing)
**Root cause:** Deposit mints afEth shares valued at oracle prices (VotiumStrategy.price()/approxPrice) while the actual ETH->safEth/vAfEth trades execute at true market prices; when the deposit ratio differs from the underlying balance ratio, the implicit trade is mispriced.
**Steps:**
1. Observe VotiumStrategy.price() uses Chainlink CVX/ETH with 2% deviation threshold, so true price can differ up to 2% from reported.
2. Deposit ETH into AfEth; it is split by `ratio` and sold for safEth and vAfEth at true prices, but shares minted use oracle-estimated value.
3. Immediately request/execute withdrawal (possible when votium locks are unlocked) which redeems proportionally from actual balances at true prices.
4. Repeat while oracle/true price discrepancy persists to extract value from existing holders.
**How found:** Reasoned that deposit uses two different prices (true trade price vs oracle-estimated value) and that when the split ratio diverges from underlying balance ratio, the deposit implicitly performs a mispriced trade; constructed numeric examples showing deposit-then-withdraw profit.
**Exploitation:** Deposit ETH when oracle price understates/overstates relative to true trade price, receive more afEth shares than the true value deposited, then withdraw to redeem a larger proportional share of underlying assets, netting profit at the expense of existing holders.
**Insight:** When a vault mints shares from an oracle price but acquires assets at a different execution price, any gap between the two (or between deposit ratio and balance ratio) is an arbitrage; check whether deposit and withdrawal use the same price source.