[ARFC] Onboard ezETH to Aave V3 Lido Instance

[Certora]

Following a thorough review of the ezETH price cap adapter smart contract, we can confirm the oracle is secure for use.

The contract operates similarly to other LST price cap oracles, and after tracing its design to the Renzo implementation, we verified that the contract correctly returns price data in the expected economic units of [base_currency]/[LST], maintaining the precision of the ETH-USD Chainlink oracle decimals.

In particular, we focused on BGD’s concern regarding the possibility of inflating ezETH’s valuation through donation attacks.

@bgdlabs

During the analysis, we identified that the exchange rate of ezETH can be inflated due to the accounting of stETH being queried directly via the balanceOf function. However, the potential for profitable manipulation through donations is effectively minimized and useless , given the following points:

• As the listing of ezETH will happen after Aave v3.2, the main use case of the asset will be as collateral on an ezETH/wstETH eMode, or as collateral to borrow other assets is other eModes or non-eMode. Not being borrowable stops any potential attack.
• Donating stETH to artificially increase the price of ezETH and borrow more wstETH is not economically viable on the base layer (Renzo). This is because donating stETH represents a real cost and a permanent loss. The attacker wouldn’t receive any ezETH, and the potential benefit gained from being able to borrow more wstETH due to an increase in the collateral’s value is unlikely to offset the cost of donated stETH. And still, the non-borrowable configuration on Aave supersedes this consideration.
• Even if the price of ezETH reaches the maximum growth ratio (maxYearlyRatioGrowthPercent) in the CAPO oracle, creating arbitrage opportunities on the borrowing side, this behavior is short-lived and self-correcting, as withdrawals will quickly deplete the ezETH supply to sell it on the market at the inflated price.

BGD rightly notes that this type of manipulation could harm Aave users if ezETH were borrowable. By artificially inflating the price of the LST through ETH donations, an attacker could trigger liquidations, profiting from the discounted auction of collateral. As long as ezETH remains non-borrowable, the potential for such an attack is, of course, nullified.

When ezETH is used as collateral, the scenario is unfavorable for an attacker. The cost of inflating the price through donations is higher than the benefit gained from increased borrowing power, even under the most extreme conditions (e.g., holding 100% of ezETH supply). For any realistic holding fraction, the cost-benefit ratio of this attack strategy diminishes further, making it economically unviable.

In conclusion, we are confident that the price cap adapter is robust against donation-based price manipulation, and no significant risk to the protocol has been identified.

We attached mathematical reasoning of our conclusion for the collateral safety:
ezETH Price Cap Adapter.pdf (99.9 KB)