Reddio exploit analysis

The Reddio RedSonic Vault on Ethereum was a Diamond/EIP-2535 vault whose getTotalAssetBalance(asset) summed each provider's leg plus getRemainingBalance(asset), with getRemainingBalance for a non-native asset implemented as IERC20(asset).balanceOf(vault). Nothing in the verified InvestmentManagerFacet (0x47F018dc00307cd48Fd71d489d92e550646598De) separated the stETH backing the ETH class from any other stETH held by the vault. Because the ETH class priced itself against the vault's raw stETH balance and the registerErc20 function on the vault was permissionless, an attacker could register stETH as a second tracked asset and then deposit stETH into the same raw balance the ETH class was already reading, inflating rsvETH's share price without minting any new rsvETH. Redeeming rsvETH at the inflated rate paid out ETH the attacker had not contributed.

The attacker (EOA 0x70f2333d21Ed7E7D105F6578227A9A747687982C, transaction origin) ran the attack inside a contract-creation transaction on block 25912201 of Ethereum, executed end-to-end in the constructor of the deployed exploit contract. The vault sat at 0x4315990D9eeAFFdFAfD49958b4851F203FA1126f (the RSV diamond). The whole exploit was funded by a Balancer flash loan of 1,139.6159 WETH, wrapped from ETH and unwrapped to ETH at the end of the transaction.

Inside the Balancer receiveFlashLoan callback the attacker first called registerErc20(stETH) to add stETH as a second tracked asset, then depositEth{value: 1,130.2592... ETH} to acquire ~99 percent of the rsvETH supply, then submitted ~9.3566 ETH to Lido to mint stETH and deposited ~9.3366 stETH into the vault. That deposit landed in the same raw stETH balance the rsvETH class priced against, so the rsvETH share price inflated without minting any rsvETH shares. The attacker then called manualWithdraw(rsvETH, all) to redeem rsvETH at the inflated rate, recovering ~1,139.5139 ETH, recovered the deposited stETH through manualWithdraw(rsvstETH, all), swapped it back to ETH on Curve's stETH/ETH pool, rewrapped and repaid the Balancer flash loan, and forwarded the ~9.25 ETH surplus to the attacker EOA.

The fix is to track per-share-class reserves for non-native assets rather than reading the vault's raw token balance. A simpler guardrail is to make registerErc20 permissioned: there is no protocol design reason for an arbitrary address to be able to add a new tracked asset to a live vault.