Malicious or compromised admin of certain LSTs could manipulate the price
Important Per the contest detail page, admins of the external protocols are marked as "Restricted" (Not Trusted). This means that any potential issues arising from the external protocol's admin actions (maliciously or accidentally) are considered valid in the context of this audit.\\nQ: Are the admins of the protocols your contracts integrate with (if any) TRUSTED or RESTRICTED?\\nRESTRICTED\\nNote This issue also applies to other support Liquid Staking Tokens (LSTs) where the admin could upgrade the token contract code. Those examples are omitted for brevity, as the write-up and mitigation are the same and would duplicate this issue.\\nPer the contest detail page, the protocol will hold and interact with the Swell ETH (swETH).\\nLiquid Staking Tokens\\nswETH: 0xf951E335afb289353dc249e82926178EaC7DEd78\\nUpon inspection of the swETH on-chain contract, it was found that it is a Transparent Upgradeable Proxy. This means that the admin of Swell protocol could upgrade the contracts.\\nTokemak relies on the `swEth.swETHToETHRate()` function to determine the price of the swETH LST within the protocol. Thus, a malicious or compromised admin of Swell could upgrade the contract to have the `swETHToETHRate` function return an extremely high to manipulate the total values of the vaults, resulting in users being able to withdraw more assets than expected, thus draining the LMPVault.\\n```\\nFile: SwEthEthOracle.sol\\n    function getPriceInEth(address token) external view returns (uint256 price) {\\n        // Prevents incorrect config at root level.\\n        if (token != address(swEth)) revert Errors.InvalidToken(token);\\n\\n        // Returns in 1e18 precision.\\n        price = swEth.swETHToETHRate();\\n    }\\n```\\n
The protocol team should be aware of the above-mentioned risks and consider implementing additional controls to reduce the risks.\\nReview each of the supported LSTs and determine how much power the Liquid staking protocol team/admin has over its tokens.\\nFor LSTs that are more centralized (e.g., Liquid staking protocol team could update the token contracts or have the ability to update the exchange rate/price to an arbitrary value without any limit), those LSTs should be subjected to additional controls or monitoring, such as implementing some form of circuit breakers if the price deviates beyond a reasonable percentage to reduce the negative impact to Tokemak if it happens.
Loss of assets in the scenario as described above.
```\\nFile: SwEthEthOracle.sol\\n    function getPriceInEth(address token) external view returns (uint256 price) {\\n        // Prevents incorrect config at root level.\\n        if (token != address(swEth)) revert Errors.InvalidToken(token);\\n\\n        // Returns in 1e18 precision.\\n        price = swEth.swETHToETHRate();\\n    }\\n```\\n