The deposited amount is included in how rsEthAmountToMint is calculated and it should not. Second depositors get less rsETH shares than deserved. #777
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
duplicate-62
satisfactory
satisfies C4 submission criteria; eligible for awards
sufficient quality report
This report is of sufficient quality
upgraded by judge
Original issue severity upgraded from QA/Gas by judge
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L136
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L109
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTOracle.sol#L70
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L49
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L79
Vulnerability details
Impact
All deposits, starting with the second one, incur a loss in the received rsETH amount.
Proof of Concept
LRTDepositPool::depositAsset
helps users to stake LST in exchange for rsETH shares.First the LST is transferedFrom user to depositPool and rsETH is minted to depositor.
The amount of rsETH to mint is calculated by
getRsETHAmountToMint
as following:lrtOracle.getRSETHPrice
callsLRTDepositPool::getTotalAssetDeposits
->getAssetDistributionData
to get LST assets amounts distributed among depositPool, NDCs and eigenLayer to calculate the rsETH/ETH exchange rate.So rsETHPrice is calculated as: `rsETHPrice = totalAssetDeposits * assetPrice / rsEthSupply
The issue rely in including the current deposit amount in the rsETH/ETH price calculation and then in rsETH amounts to mint formula.
Let's take the following example:
Note: to simplify I approximate the LST/ETH ratio to 1e18.
getRSETHPrice
returns 1 ether.Alice will mint:
rsEthAmountToMint = 1 ether * 1e18 / (1 ether * 1e18 / 1 ether)
rsEthAmountToMint = 1 ether rsETH
rsEthAmountToMint = 10 ether * 1e18 / ( (1 ether + 10 ether) * 1e18 /1 ether)
rsEthAmountToMint = 10/11 ether rsETH
Alice deposited 1 ether LSD and got 1 ether rsETH
Bob deposited 10 ether LSD and got less than 1 ether rsETH.
Tools Used
Manual Review
Recommended Mitigation Steps
Update
LRTDepositPool::depositAsset
: save rsethAmountToMint, transfer assets, mint rsETH shares to user:Assessed type
Other
The text was updated successfully, but these errors were encountered: