Kelp DAO | rsETH - 0xluckhu's results

A collective DAO designed to unlock liquidity, DeFi and higher rewards for restaked assets through liquid restaking.

General Information

Platform: Code4rena

Start Date: 10/11/2023

Pot Size: $28,000 USDC

Total HM: 5

Participants: 185

Period: 5 days

Judge: 0xDjango

Id: 305

League: ETH

Kelp DAO

Findings Distribution

Researcher Performance

Rank: 68/185

Findings: 2

Award: $38.79

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

36.0335 USDC - $36.03

Labels

bug
3 (High Risk)
satisfactory
sufficient quality report
upgraded by judge
duplicate-62

External Links

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L136-L141 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L79

Vulnerability details

Impact

In LRTDepositPool::depositAsset(), it calculates the rsETH amount to be minted to the depositor per the input asset amount (a), the asset:ETH price (pa) and rsETH:ETH price (pb): (a*pa)/pb.

Per design, the rsETH:ETH price shall be calculated per the current assets balances and the current rsETH supply in the protocol. However, current implementation takes the new deposit amount also into the calculation of the rsETH:ETH price, because the new deposit is transferred into the contract before the calculation of the rsETH:ETH price. As a result, the rsETH:ETH price is a somehow higher than expected and the depositor will get less rsETH minted.

Proof of Concept

  1. In LRTDepositPool::depositAsset(), it pulls the new deposit into the contract first (line 136), then calculates the rsETH amount to be minted to the depositor (line 141).
  2. The new rsETH amount depends on the rsETH:ETH price which is calculated per the total assets in the pool and the rsETH supply. The total assets is retrieved by LRTDepositPool::getTotalAssetDeposits() function. Because we have pulled in the new deposit in step 1, the total assets deposits becomes bigger than expected. As a result, the calculated rsETH:ETH price gets higher than expected and the new rsETH amount gets smaller than expected. Finally, the depositor gets less rsETH.

Tools Used

In LRTDepositPool::depositAsset(), _mintRsETH() first and pull user deposit at last (i.e., IERC20(asset).transferFrom()).

Assessed type

Timing

#0 - c4-pre-sort

2023-11-16T00:16:04Z

raymondfam marked the issue as sufficient quality report

#1 - c4-pre-sort

2023-11-16T00:16:19Z

raymondfam marked the issue as duplicate of #62

#2 - c4-judge

2023-11-29T21:19:59Z

fatherGoose1 marked the issue as satisfactory

#3 - c4-judge

2023-12-01T19:00:05Z

fatherGoose1 changed the severity to 2 (Med Risk)

#4 - c4-judge

2023-12-04T15:31:41Z

fatherGoose1 changed the severity to 3 (High Risk)

Awards

2.7592 USDC - $2.76

Labels

bug
downgraded by judge
grade-b
insufficient quality report
primary issue
QA (Quality Assurance)
Q-111

External Links

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTDepositPool.sol#L141

Vulnerability details

Impact

In LRTDepositPool::depositAsset(), if the new rsETH amount is 0, the deposit asset gets lost.

Proof of Concept

In LRTDepositPool::depositAsset(), the new rsETH amount to be minted to the depositor is calculated per the deposit amount and the rsETH price. In case the new deposit amount is very small and the rsETH is expensive, the new calculated rsETH amount may be 0. As a result, user's deposit is pulled in but no rsETH is minted to the user.

Tools Used

Add a check at the end of the LRTDepositPool::depositAsset(), and revert when the new rsETH amount is 0.

Assessed type

Math

#0 - c4-pre-sort

2023-11-16T00:19:37Z

raymondfam marked the issue as insufficient quality report

#1 - raymondfam

2023-11-16T00:21:45Z

Insufficient proof as illustrated in #42.

#2 - c4-pre-sort

2023-11-16T00:22:33Z

raymondfam marked the issue as primary issue

#3 - fatherGoose1

2023-12-01T16:58:35Z

Does not describe a donation attack. Simply explains that a user can be minted 0 shares as a result of depositing a small amount. QA

#4 - c4-judge

2023-12-01T16:58:45Z

fatherGoose1 changed the severity to QA (Quality Assurance)

#5 - c4-judge

2023-12-01T16:58:50Z

fatherGoose1 marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter