Careful Mocha Vulture - `deposit()` Will Always Revert Because Slippage Tolerance `LIDO_ERROR_TOLERANCE_ETH` Is Too Low

[sherlock-admin4]

Careful Mocha Vulture

High

deposit() Will Always Revert Because Slippage Tolerance LIDO_ERROR_TOLERANCE_ETH Is Too Low

Summary

LIDO_ERROR_TOLERANCE_ETH is set to 10, which is too low and will cause the deposit() function to always revert.

Vulnerability Detail

The deposit function includes a slippage tolerance check to ensure that the amount of stETH received from Lido is within the expected range. However, the slippage tolerance is set to 10, which is too low and will always revert the deposit() function:

LidoVault.sol#L1017-L1018

    /// @notice ETH diff tolerance either for the expected deposit or withdraw from Lido - some rounding errors of a few wei seem to occur
->  uint256 public constant LIDO_ERROR_TOLERANCE_ETH = 10 wei;

LidoVault.sol#L348-L355

      // Stake on Lido
      /// returns stETH, and returns amount of Lido shares issued for the staked ETH
      uint256 stETHBalanceBefore = stakingBalance();
      uint256 shares = lido.submit{value: amount}(address(0)); // _referral address argument is optional use zero address
      require(shares > 0, "ISS");
      // stETH transfered from Lido != ETH deposited to Lido - some rounding error
      uint256 stETHReceived = (stakingBalance() - stETHBalanceBefore);
->    require((stETHReceived >= amount) || (amount - stETHReceived <= LIDO_ERROR_TOLERANCE_ETH), "ULD");

As shown in the deployed Lido contract, the exchange rate is not 1:1. At the time of writing, 1 ETH is equivalent to 0.848033148273146669 stETH: Lido Contract on Etherscan

Impact

DoS on the deposit function.

Code Snippet

LidoVault.sol#L348-L355

Tool used

Manual Review

Recommendation

Set LIDO_ERROR_TOLERANCE_ETH to a higher value.

[vizay9652]

This is design choice