tobi0x18 - Fixed side depositors won't be eligible for referral rewards for depositing ETH

[sherlock-admin3]

tobi0x18

Medium

Fixed side depositors won't be eligible for referral rewards for depositing ETH

Summary

When fixed side depositors deposits some amount of Ether to the vault, it deposits to the Lido. However, it sets its referral address as address(0). As a result, they can't receive referral rewards for depositing ETH.

Root Cause

When fixed side depositors deposits some amount of Ether to the vault, it deposits to the Lido. At LidoVault.sol#L351, it deposits Ether to the Lido. However, it sets a referral address as address(0)

File: lido-fiv\contracts\LidoVault.sol
328:   function deposit(uint256 side) external payable {
           [...]
351:       uint256 shares = lido.submit{value: amount}(address(0)); // _referral address argument is optional use zero address

The Lido protocol allows caller to pass referral argument when depositing ETH, and referral account can be eligible for referral rewards if it is valid.

The _referral parameter indicates the referral account which will be eligible for referral rewards. If a fixed depositor is eligible for referral rewards, he can't receive any rewards.

Internal pre-conditions

No response

External pre-conditions

Fixed side depositors are eligible for referral rewards.

Attack Path

No response

Impact

Fixed side depositors won't be eligible for referral rewards as expected, this can be significant value leak to the them.

PoC

No response

Mitigation

Use the address of a caller as referral instead address(0).

-       uint256 shares = lido.submit{value: amount}(address(0)); // _referral address argument is optional use zero address
+       uint256 shares = lido.submit{value: amount}(msg.sender);