Users are at risk of receiving zero RsETH when supplying a small enough amount of supported assets during the minting process, potentially resulting in the loss of their assets to other stakers.
Proof of Concept
The minting of RsETH occurs through the depositAsset() function, where users supply supported assets to receive corresponding RsETH tokens. Within this process, _mintRsETH() determines the rsethAmountToMint using getRsETHAmountToMint().
function _mintRsETH(address _asset, uint256 _amount) private returns (uint256 rsethAmountToMint) {
(rsethAmountToMint) = getRsETHAmountToMint(_asset, _amount);
address rsethToken = lrtConfig.rsETH();
// mint rseth for user
IRSETH(rsethToken).mint(msg.sender, rsethAmountToMint);
}
The calculation of rsethAmountToMint within getRsETHAmountToMint() is determined as follows: the ETH value of the provided asset divided by the RsETH price.
Currently protocol supports stETH, rETH and cbETH. The issue arises when a user, prompted by a significantly lower price of the supported assets compared to the other 2, attempts to mint a notably small amount. In such instances, the calculation for rsethAmountToMint can potentially return zero due to division truncation, resulting in the user receiving no stake of the total pool, while their asset is transferred into the protocol.
Tools Used
Manual Review
Recommended Mitigation Steps
The protocol should consider minimum depositAmount in depositAsset() or revert when rsethAmountToMint == 0
function _mintRsETH(address _asset, uint256 _amount) private returns (uint256 rsethAmountToMint) {
(rsethAmountToMint) = getRsETHAmountToMint(_asset, _amount);
+ if(rsethAmountToMint == 0) revert();
address rsethToken = lrtConfig.rsETH();
// mint rseth for user
IRSETH(rsethToken).mint(msg.sender, rsethAmountToMint);
}
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L119 https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L151 https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L95 https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTOracle.sol#L52
Vulnerability details
Impact
Users are at risk of receiving zero RsETH when supplying a small enough amount of supported assets during the minting process, potentially resulting in the loss of their assets to other stakers.
Proof of Concept
The minting of RsETH occurs through the
depositAsset()
function, where users supply supported assets to receive corresponding RsETH tokens. Within this process,_mintRsETH()
determines thersethAmountToMint
usinggetRsETHAmountToMint()
.The calculation of
rsethAmountToMint
withingetRsETHAmountToMint()
is determined as follows: the ETH value of the provided asset divided by the RsETH price.The RsETH price is derived from the aggregated ETH value of all supported assets in the protocol divided by the RsETH
totalSupply
.Currently protocol supports stETH, rETH and cbETH. The issue arises when a user, prompted by a significantly lower price of the supported assets compared to the other 2, attempts to mint a notably small amount. In such instances, the calculation for
rsethAmountToMint
can potentially return zero due to division truncation, resulting in the user receiving no stake of the total pool, while their asset is transferred into the protocol.Tools Used
Manual Review
Recommended Mitigation Steps
The protocol should consider minimum
depositAmount
indepositAsset()
or revert whenrsethAmountToMint == 0
Assessed type
Math