# Dangerous 1 to 1 price assumption for ETH derivatives

Opal Omnipool prices rETH/vETH/uniETH via ETH/USD feed assuming 1:1 peg, letting users profit from depeg on deposit/withdraw.

- Payout: Contest reward
- Severity: medium
- Program: Opal
- Credited: giraffe0x
- Disclosed: 2024-03-30
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.3.17
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.17
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Omnipool.sol / BPTOracle price feed handling
**Root cause:** Omnipool only supports tokens with a Chainlink USD feed and tests wired ETH derivatives (rETH, vETH, uniETH) to the ETH/USD feed, implicitly assuming 1 derivative = 1 ETH instead of using the derivative/ETH feed.
**Steps:**
1. Observe Omnipool.sol#L247 calls `bptOracle.getUSDPrice(address(underlyingToken))`, requiring a USD feed.
2. Note BPTOracle.t.sol registers rETH/vETH/uniETH against the ETH/USD feed `0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419` with comments 'considering 1rETH = 1ETH'.
3. Deposit phase: Omnipool valuation $100000, rETH=$1500, WETH=$1200; beforeUnderlyingAmount = 100000/1200 = 83.33 (WETH price used), exchangeRate = 0.833; Alice deposits 1 rETH ($1500) and receives 1.2 LP.
4. Depeg phase: rETH=$1500, WETH=$900; totalSupply=101.2, valuation=$101500; totalUnderlying = 101500/900 = 112.78; exchangeRate = 1.11.
5. Alice withdraws 1.2 * 1.11 = 1.332 rETH, netting 0.332 rETH profit at other LPs' expense.
**How found:** Code reading of Omnipool's oracle call revealed it requires a USD feed; cross-referencing the test file showed ETH derivatives mapped to the ETH/USD feed with explicit '1 rETH = 1 ETH' comments, exposing the flawed peg assumption.
**Exploitation:** Attacker deposits an ETH derivative while its market price exceeds the assumed 1:1 ETH value, waits for a temporary depeg of WETH/ETH (or derivative premium), then withdraws to receive more underlying than deposited, diluting other LPs.
**Insight:** When a protocol's tests wire derivative tokens to the base-asset feed with 'considering 1 X = 1 Y' comments, that's a live mispricing: model deposit/withdraw exchange-rate math across a depeg to quantify LP dilution.