The rsETH price will fluctuate if someone directly transfer stETH/cbETH/rETH to depositPool or nodeDelegator.
Proof of Concept
The stETH/cbETH/rETH to ETH price approximately equals to 1. So the rsETH to ETH price approximately equals to 1. But if someone directly transfer stETH/cbETH/rETH to depositPool or nodeDelegator the rsETH price will fluctuate. When withdraw function is implemented for the protocol, people who minted rsETH early will withdraw to get more asset than they deposited.Meanwhile, the deposit amount of asset has limits. The increase in pool assets will have an impact on others' deposits.
Tools Used
Manual
Recommended Mitigation Steps
Consider adding a value to record depositAmount. The rsETH price is calculated with depositAmount, not balanceOf(address(this)).
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L79 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L83
Vulnerability details
Impact
The rsETH price will fluctuate if someone directly transfer stETH/cbETH/rETH to depositPool or nodeDelegator.
Proof of Concept
The stETH/cbETH/rETH to ETH price approximately equals to 1. So the rsETH to ETH price approximately equals to 1. But if someone directly transfer stETH/cbETH/rETH to depositPool or nodeDelegator the rsETH price will fluctuate. When withdraw function is implemented for the protocol, people who minted rsETH early will withdraw to get more asset than they deposited.Meanwhile, the deposit amount of asset has limits. The increase in pool assets will have an impact on others' deposits.
Tools Used
Manual
Recommended Mitigation Steps
Consider adding a value to record depositAmount. The rsETH price is calculated with depositAmount, not
balanceOf(address(this))
.Assessed type
Other