Lack of withdraw function in LRTDepositPool. Once user deposits token to LRTDepositPool he will lost his assets.
Proof of Concept
In LRTDepositPool, the user can only deposit tokens but he can't withdraw his assets. There is no other way to change rsEth back his assets. It will cost user assets to lose.
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/ee1154fcb6f6619cdc9aeda27503d9a2cbf6d8eb/src/LRTDepositPool.sol#L19
Vulnerability details
Impact
Lack of withdraw function in
LRTDepositPool
. Once user deposits token toLRTDepositPool
he will lost his assets.Proof of Concept
In
LRTDepositPool
, the user can only deposit tokens but he can't withdraw his assets. There is no other way to changersEth
back his assets. It will cost user assets to lose.Tools Used
manual
Recommended Mitigation Steps
add
withdraw
logicAssessed type
Context