# The current idea of ​​creating reETH and accepting several different assets in it exposes RIO users to losses

Rio's reETH LRT accepts multiple assets; attacker deposits before a predictable price drop, then withdraws after, socializing losses onto existing users.

- Payout: Contest reward
- Severity: medium
- Program: Rio Network Core Protocol
- Credited: ComposableSecurity
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/386
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** RioLRTCoordinator.sol deposit/withdraw logic
**Root cause:** LRT minting and redemption use a price feed that only updates after a price drop, allowing deposits at pre-drop value and withdrawals at post-drop value.
**Steps:**
1. Attacker monitors slashing events or large withdrawals to predict a price drop in cbETH/wstETH.
2. Attacker deposits 100 cbETH when 1 cbETH = 2 ETH, receiving 200 reETH.
3. Price drops 50% (1 cbETH = 1 ETH); total TVL decreases.
4. Attacker requests withdrawal of 200 cbETH by burning 150 reETH (for cbETH) and 100 reETH (for 50 ETH).
5. Attacker receives 200 cbETH (now worth 100 ETH) plus 50 ETH, then buys more cbETH.
6. After price recovery, attacker profits while Rio users lose.
**How found:** Reasoned about economic incentives: LRT accepts multiple assets, price feed lags actual price drops, and withdrawals can be in different assets than deposits, enabling risk transfer.
**Exploitation:** Attacker deposits a depreciating asset before a known price drop, then withdraws a mix of assets after the drop, extracting more value than deposited and leaving losses with other users.
**Insight:** In multi-asset LRTs, check if deposit/withdraw pricing uses a lagging oracle and if users can withdraw different assets than deposited; predictable price drops (slashing, large withdrawals) create risk-free profit for attackers at the expense of existing users.