The LRTManager is allowed to deposit the entire balance of a nodeDelegator into eigenlayer via the depositIntoStrategy
There is missing a key function in the NodeDelegator contract that should allow for withdrawing funds from eigen, currently if the nodeDeleagtor calls depositAssetIntoStrategy the funds sent are essentially lost with no way of recovering them.
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/main/src/NodeDelegator.sol#L51-L68
Vulnerability details
Impact
The LRTManager is allowed to deposit the entire balance of a nodeDelegator into eigenlayer via the depositIntoStrategy
There is missing a key function in the NodeDelegator contract that should allow for withdrawing funds from eigen, currently if the nodeDeleagtor calls depositAssetIntoStrategy the funds sent are essentially lost with no way of recovering them.
Proof of Concept
https://github.com/code-423n4/2023-11-kelp/blob/main/src/NodeDelegator.sol#L51-L68
Tools Used
Manual Review
Recommended Mitigation Steps
Implement a function that can withdraw the deposited and rewards from eigen
Assessed type
Other