# Native vs wrapped ETH identity confusion

Hardcoded or sentinel ETH/WETH handling in exit, repay, and swap paths that breaks token identity

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-06-27. Updated 2026-10-23._

## How it works
A protocol treats native ETH and WETH as interchangeable in some places but distinct in others. The assumption that breaks: that the coin a pool or module delivers matches the coin the next step expects. When a Curve pool's ETH index holds WETH, the pool still returns native ETH on exit; when a sentinel like `0xEeee...` or `address(0)` stands in for ETH, downstream code may unwrap, re-wrap, or look up a registry keyed on a different address. The result is a balance that never arrives, a revert, or a lookup that finds nothing.

## Where it shows up
- Hardcoded `useEth = true` (or `use_eth`) on exit/remove-liquidity paths while entry derives it from `msgValue` [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-9.md)
- Re-wrap logic gated on `TOKEN_1/TOKEN_2 == ETH_ADDRESS` rather than the actual coin address [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-9.md)
- `WETH.withdraw` called on a path where the contract holds native ETH, not WETH [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-3.md)
- Strict `tokens[i] == asset` equality checks after an earlier ETH->WETH normalization [E3](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-10.md)
- Sentinel rewriting (`0xEeee` -> `0x0`) feeding a registry/mapping lookup with no entry for the normalized key [E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-23.md)

## How to review
The invariant: every path that moves value must agree on one canonical asset identity, and that identity must be derived from the actual coin address, not hardcoded or assumed. Check that entry and exit `use_eth` flags are symmetric and derived from `msgValue`/coin address [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-9.md). Trace each sentinel or normalization step to every downstream consumer: unwrap calls [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-3.md), equality/skip checks [E3](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-10.md), and registry lookups [E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-23.md). Confirm the contract's actual balance matches the token it then operates on.

## Variants seen
- Hardcoded exit flag returns native ETH from a WETH pool; funds stuck, withdrawals return zero [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-9.md)
- TradingModule delivers native ETH where strategy expects WETH; `WETH.withdraw` reverts, ETH-pool deposits fail [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-3.md)
- Post-normalization equality check misses primary token, triggering invalid swap that reverts redemption [E3](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-10.md)
- Sentinel rewrite to `address(0)` has no registered manager, so withdrawal/liquidation loops revert and lock funds [E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-23.md)

## Impact and severity
Stuck funds and blocked redemptions/exits [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-9.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-10.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-23.md), plus DoS of deposits into ETH pools [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-3.md). Severity rises when the broken path is the only exit or liquidation route, since funds become unrecoverable without an upgrade.

## Why fixes fail
Fixes that patch one path leave the asymmetry: entry derived correctly but exit hardcoded [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-9.md), or normalization added without updating downstream equality checks [E3](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-10.md) and registry keys [E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-23.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-9.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-3.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-10.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-23.md