When depositAsset, the price of RsETH is related to the depositAmount. The larger the depositAmount is, the higher the price of RsETH is, and the less RsETH quantity can be obtained.
this is unfair to users who deposit a lot of assets at once,
and the price of RsETH is higher than the actual expected price because the assets in the pool are calculated in advance.
LRTDepositPool#depositAsset:
function depositAsset(address asset, uint256 depositAmount)
Proof of Concept
LRTDepositPool#depositAsset,transfer asset first, then mint RsETH:
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L136 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTOracle.sol#L70
Vulnerability details
Impact
When depositAsset, the price of RsETH is related to the depositAmount. The larger the depositAmount is, the higher the price of RsETH is, and the less RsETH quantity can be obtained. this is unfair to users who deposit a lot of assets at once, and the price of RsETH is higher than the actual expected price because the assets in the pool are calculated in advance.
LRTDepositPool#depositAsset:
Proof of Concept
LRTDepositPool#depositAsset,transfer asset first, then mint RsETH:
LRTOracle#getRSETHPrice,
totalETHInPool
include the asset that is currently being deposited,the value ofrsEthSupply
is before deposit.Tools Used
vscode manual
Recommended Mitigation Steps
Get the price of RsETH before transferring the asset (calculate the number of Mint RsETH)
Assessed type
Other