# Rebasing tokens are not supported contrary to the readme and will lead to loss of funds Medium · Sherlock · Derivatives · 29th August 2024 Finding M-6 of the Cork Protocol competition. - Protocol: https://audits.sherlock.xyz/contests/506 - Codebase: https://github.com/0xsimao/2024-08-cork-protocol/tree/db23bf67e45781b00ee6de5f6f23e621af16bd7e - Source: https://github.com/sherlock-audit/2024-08-cork-protocol-judging/issues/235 --- ### Summary The readme states that rebasing tokens are [supported](https://github.com/sherlock-audit/2024-08-cork-protocol?tab=readme-ov-file#q-if-you-are-integrating-tokens-are-you-allowing-only-whitelisted-tokens-to-work-with-the-codebase-or-any-complying-with-the-standard-are-they-assumed-to-have-certain-properties-eg-be-non-reentrant-are-there-any-types-of-weird-tokens-you-want-to-integrate) > Rebasing tokens are supported with exchange rate mechanism However, only non rebasing tokens such as the wrapped version `wsteth` are supposed. If `stETH` is used, it will accrue value in the `Psm` and `Vault` (technically they are the same contract) which will be left untracked as `Ra` and `Pa` deposits are tracked in state [variables](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/State.sol#L48-L53). ### Root Cause The code does not handle rebasing tokens even though the readme says it does. The exchange rate mechanism only supports non rebasing tokens such as `wsteth`. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path Admin creates `steth` pairs using it as `Ra` or `Pa`, whose value will grow in the protocol but left untracked as the quantites are tracked with state variables. ### Impact Stuck yield accruel in the Vault/Psm contracts. ### PoC `State.sol` tracks the balances: ```solidity struct Balances { PsmRedemptionAssetManager ra; uint256 dsBalance; uint256 ctBalance; uint256 paBalance; } ``` ### Mitigation Don't set rebasing tokens are `Ra` or `Pa` or implement a way to sync the balances. --- Related findings: - [Liquidating maturies with unassigned earnings will not take into account floating assets increase leading to loss of funds](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidating-maturies-unassigned-floating): Exactly Protocol Update - Staking Contract - [reduceOnly limit order update does not take into account that a new amm may be selected, which may lead to loss of funds](https://0xsimao.com/findings/nftperp-i-reduce-account-amm-selected): Nftperp Exchange - [`LenderCommitmentGroup_Smart` does not use `mulDiv` when converting between token and share amounts, possibly leading to DoS or loss of funds](https://0xsimao.com/findings/teller-finance-mul-div-converting-share): Teller Finance - [Strategy main ticks are set according to the tick in slot0, leading to incorrect allocation and loss of funds](https://0xsimao.com/findings/yieldoor-main-according-slot0-allocation): Yieldoor