manifoldfinance / mevETH2

mevETH LST Protocol - Repo has migrated see link
https://github.com/MEV-Protocol/meveth
27 stars 2 forks source link

Audit: MANETH-43 #130

Closed sandybradley closed 1 year ago

sandybradley commented 1 year ago

INCONSISTENT MINIMUM DEPOSIT CHECK FOR ASSETS AND SHARES

SEVERITY: Medium

PATH: MevEth.sol:mint(uint256,address):L543-560

https://github.com/manifoldfinance/mevETH2/blob/63edde66d91c263b919fe9c21e128a382219880e/src/MevEth.sol#L543-L560

DESCRIPTION

When depositing, the contract checks that the assets should be greater than MIN_DEPOSIT. However, when minting, it checks that the shares should be greater than MIN_DEPOSIT. fraction.elastic will keep consistently increasing through the payment of rewards and this will cause a growing imbalance between fraction.elastic and fraction.base over time. This would cause a discrepancy between the minimum assets amount for deposit and mint and that lacks logical consistency and equality for users. It would be more reasonable and fair for both depositing and minting operations to have equal checks to ensure consistency in the contract's behavior and user experience.

Function mint can be rewritten like this:

function mint(uint256 shares, address receiver) external payable stakingUnpaused returns (uint256
assets) {
    // Convert the shares to assets and update the fraction elastic and base
    assets = convertToAssets(shares);
    // If the deposit is less than the minimum deposit, revert
    if (assets < MIN_DEPOSIT) revert MevEthErrors.DepositTooSmall();