Closed c4-submissions closed 11 months ago
raymondfam marked the issue as sufficient quality report
raymondfam marked the issue as duplicate of #62
fatherGoose1 marked the issue as satisfactory
fatherGoose1 changed the severity to 2 (Med Risk)
fatherGoose1 changed the severity to 3 (High Risk)
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L136 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L109 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTOracle.sol#L70 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L49 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L79
Vulnerability details
Impact
All deposits, starting with the second one, incur a loss in the received rsETH amount.
Proof of Concept
LRTDepositPool::depositAsset
helps users to stake LST in exchange for rsETH shares. First the LST is transferedFrom user to depositPool and rsETH is minted to depositor.The amount of rsETH to mint is calculated by
getRsETHAmountToMint
as following:lrtOracle.getRSETHPrice
callsLRTDepositPool::getTotalAssetDeposits
->getAssetDistributionData
to get LST assets amounts distributed among depositPool, NDCs and eigenLayer to calculate the rsETH/ETH exchange rate.So rsETHPrice is calculated as: `rsETHPrice = totalAssetDeposits * assetPrice / rsEthSupply
The issue rely in including the current deposit amount in the rsETH/ETH price calculation and then in rsETH amounts to mint formula.
Let's take the following example: Note: to simplify I approximate the LST/ETH ratio to 1e18.
getRSETHPrice
returns 1 ether. Alice will mint: rsEthAmountToMint = 1 ether 1e18 / (1 ether 1e18 / 1 ether) rsEthAmountToMint = 1 ether rsETHAlice deposited 1 ether LSD and got 1 ether rsETH Bob deposited 10 ether LSD and got less than 1 ether rsETH.
Tools Used
Manual Review
Recommended Mitigation Steps
Update
LRTDepositPool::depositAsset
: save rsethAmountToMint, transfer assets, mint rsETH shares to user:Assessed type
Other