# Possible arbitrage from Chainlink price discrepancy 

Chainlink LST/ETH feeds with wide deviation thresholds let depositors mint rsETH cheaply off stale prices, diluting existing holders by ~2%.

- Payout: Contest reward
- Severity: high
- Program: Kelp DAO
- Credited: m\_Rassska
- Disclosed: 2023-12-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-kelp-findings/issues/584
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-kelp%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** LRTDepositPool depositAsset / LRTOracle Chainlink LST price feeds
**Root cause:** rsETH mint rate derives from Chainlink rETH/cbETH/stETH-ETH feeds whose allowed deviations (2%/1%/0.5%) and 24h heartbeats let on-chain prices lag spot, so depositAsset mints rsETH at stale rates.
**Steps:**
1. Observe feed deviation thresholds: rETH/ETH 2%, cbETH/ETH 1%, stETH/ETH 0.5%, heartbeat 86400s.
2. Seed pool with large LST liquidity (rETH 9950, stETH 88170, cbETH 1880) at baseline prices.
3. Carol deposits 100 rETH at baseline, records rsETH minted.
4. Prices drift within bounds: rETH +2%, stETH -0.5%, cbETH -1%.
5. Bob deposits 100 rETH; assertGt(bobBalanceAfter, carolBalanceAfter*102/100) shows ~2% more rsETH minted for same input.
**How found:** Reasoned from oracle config: noted deviation thresholds and heartbeat are large relative to LST spot variance, cross-referenced LSD market shares to model pool composition, then simulated price drift within allowed bounds to quantify mint imbalance.
**Exploitation:** Attacker monitors Chainlink feeds and deposits the LST whose on-chain price is stale-low relative to spot, minting more rsETH than fair value, then exits via secondary market or future withdrawals, extracting value from the shared deposit pool.
**Escalation:** Profit scales with pool liquidity; judge notes once withdrawals exist without staking delay, large on-chain LST liquidity could be drained on even 1% discrepancy.
**Insight:** When a protocol prices mints from multiple oracle feeds each with independent deviation bands, the worst-case combination of all feeds drifting to opposite band edges (not just one) yields the max mispricing; model the joint band, not single-feed deviation.