Closed code423n4 closed 1 year ago
0xSorryNotSorry marked the issue as duplicate of #193
GalloDaSballo marked the issue as partial-50
Poor description and no coded POC, but does explain the vulnerability
GalloDaSballo changed the severity to 2 (Med Risk)
GalloDaSballo marked the issue as duplicate of #343
GalloDaSballo marked the issue as partial-25
There is no issue here. If priorTokenBalance
is 1
, then amount*totalShares
is the correct amount of shares to mint in order to withdraw the same amount as was deposited. Withdrawing gives _tokenBalance() * amountShares / priorTotalShares
which in our case if we withdraw our shares again is (1 + amount) * (amount*totalShares) / (totalShares + amount*totalShares)
= amount
.
GalloDaSballo changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/Layr-Labs/eigenlayer-contracts/blob/dbeb85bcd0476e06b8feebf07e33f8a53d54c029/src/contracts/strategies/StrategyBase.sol#L99
Vulnerability details
Impact
deposit()
function is calculating wrong value ofnewShare
which will cause hyper inflation ofnewShare
Proof of Concept
If
priorTokenBalance
is1
, thennewShares = (amount * totalShares) / priorTokenBalance
willamount*totalShares/1
and thenewShare
will beamount*totalShares
Here
amount
will be the input and totalShares will be thenumber of extant shares in thie Strategy
so newshares could be more then intended.Tools Used
Manual Review
Recommended Mitigation Steps
maybe you could use if condition to check if
priorTokenBalance
is 1Assessed type
Math