RedSonic’s permissionless registerErc20() allowed stETH to be registered as a separate vault asset even though the ETH vault’s rsvETH share price already counted the vault’s raw stETH balance through its Lido position. As a result, the same stETH balance simultaneously backed rsvETH and newly minted rsvstETH shares. The attacker deposited stETH to inflate the rsvETH share price, redeemed rsvETH against that inflated valuation, then redeemed rsvstETH to recover the same stETH collateral, effectively using one asset balance to support two share classes