# Reddio RedSonic Vault: shared stETH balance inflates rsvETH share price

Permissionless registerErc20 on Reddio's RedSonic Vault let an attacker back two share classes with one raw stETH balance, inflating rsvETH price and draining ~9.25 ETH via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: Reddio
- Disclosed: 2026-09-05
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/Reddio_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260905-reddio
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** EIP-2535 diamond vault (InvestmentManagerFacet) on Ethereum
**Root cause:** getTotalAssetBalance/getRemainingBalance price each share class off the vault's raw token balance with no per-class accounting, and registerErc20 is permissionless, so a newly registered stETH class shares the same raw stETH balance the ETH class already prices against.
**Steps:**
1. Flash-loan 1,139.6159 WETH from Balancer Vault `0xBA12...F2C8`, unwrap to ETH
2. Call `registerErc20(stETH)` on RSV diamond `0x4315...126f` (permissionless)
3. `depositEth{value:1130.2592 ETH}()` to acquire ~99% of rsvETH supply
4. Lido `submit` ~9.3566 ETH -> stETH, approve vault, `depositErc20(stETH, ~9.3366)` to inflate rsvETH price without minting rsvETH
5. `manualWithdraw(rsvETH, all)` redeems at inflated rate (~1,139.5139 ETH)
6. `manualWithdraw(rsvstETH, all)` recovers deposited stETH
7. Curve `exchange(1,0,...)` swaps stETH back to ETH
8. Re-wrap WETH, repay Balancer, forward ~9.25 ETH profit to attacker EOA
**How found:** Code-reading of the verified InvestmentManagerFacet: noticed getRemainingBalance for non-native assets returns raw IERC20.balanceOf(vault) and the Lido provider leg also reads raw stETH balance, with no per-share-class tracking; combined with permissionless registerErc20 this allows one balance to back two classes.
**Exploitation:** Single flash-loan-funded contract-creation tx (0xe3cb...791a, block 25912201): borrow WETH, register stETH as second asset, dominate rsvETH supply, deposit stETH to inflate share price, redeem rsvETH at inflated rate, recover stETH, swap back via Curve, repay loan, keep ~9.25 ETH.
**Insight:** In multi-share-class vaults, check whether pricing getters read raw token balances shared across classes rather than per-class accounting, and whether asset registration is permissionless — a second registration can double-count the same backing.