EETH Deposits Would Be Non-Functional If WhiteListing Is Turned On

Summary

Note this is unrelated to if external admins are trusted , this is a feature which can be toggled in the EETH Liquidity Pool Contract . If whitelisting is turned on on the EETH liquidity pool then it would make the deposit to the weETH pool impossible (via depositing ETH or WETH) since it would always revert.

Vulnerability Detail

1.) The farming period has begun and users can now deposit to earn rewards.

2.) User holds ETH/WETH and wants to deposit into the weETH pool.

3.) Calls depositEth here https://github.com/sherlock-audit/2024-05-sophon/blob/main/farming-contracts/contracts/farm/SophonFarming.sol#L503

4.) Since the user wants to deposit into the weETH pool , this code snippet would trigger

} else if (_predefinedPool == PredefinedPool.weETH) {
            _finalAmount = _ethTOeEth(_finalAmount);
        }

which triggers ,

function _ethTOeEth(uint256 _amount) internal returns (uint256) {
        // deposit returns exact amount of eETH
        return IeETHLiquidityPool(eETHLiquidityPool).deposit{value: _amount}(address(this));
    }

5.) In the deposit function of the eETH Liquidity pool contract here https://github.com/etherfi-protocol/smart-contracts/blob/master/src/LiquidityPool.sol#L148 , it would revert if the whitelisting mechanism has been turned on by the eETH team.

Therefore , a user trying to deposit into the weETH pool would encounter a DoS and this breaks a core functionality of the contract.

Impact

A user trying to deposit into the weETH pool would encounter a DoS and this breaks a core functionality of the contract.

Code Snippet

https://github.com/sherlock-audit/2024-05-sophon/blob/main/farming-contracts/contracts/farm/SophonFarming.sol#L834

Tool used

Manual Review

Recommendation

These kind of risks should be acknowledged , also alt solution can be to re-route the deposit into the wstETH pool in such case.

sherlock-audit / 2024-05-sophon-judging

MightyRaju - EETH Deposits Would Be Non-Functional If WhiteListing Is Turned On #135