Depositor get's extra shares to keep

[code423n4]

Lines of code

https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L696-L697

Vulnerability details

Impact

The number of shares of depositor should have reduced after this step but as code is not properly implemented depositor get's to keep free shares.

Proof of Concept

In the _removeShares function of Strategy Manager,after the calculation of userShares it should have been subtracted from the shares of depositor's existing shares for the particular strategy and the same is said in the comment of the function: // subtract the shares from the depositor's existing shares for this strategy but subtraction part has been forgotten by the developer,which might lead to serious logic flaws and calculation problems in terms of shares distributed.

Tools Used

Manual Audit

Recommended Mitigation Steps

Change the code in line: https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L697

to

stakerStrategyShares[depositor][strategy] -= userShares;

Assessed type

Math

[0xSorryNotSorry]

The shares are decreased in below lines and the mapping updated accordingly.

        unchecked {
            userShares = userShares - shareAmount;
        }

Invalid assumption.

[c4-pre-sort]

0xSorryNotSorry marked the issue as low quality report

[c4-judge]

GalloDaSballo marked the issue as unsatisfactory: Invalid