Kelp DAO | rsETH - 0xvj's results

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L162-L176

Vulnerability details

Impact

Accouting will go wrong and rsETH will be minted at wrong price.

Proof of Concept

1. There isn't any check to ensure that duplicates are not pushed in nodeDelegatorQueue. Here is the addNodeDelegatorContractToQueue function:

function addNodeDelegatorContractToQueue(address[] calldata nodeDelegatorContracts) external onlyLRTAdmin {
        uint256 length = nodeDelegatorContracts.length;
        if (nodeDelegatorQueue.length + length > maxNodeDelegatorCount) {
            revert MaximumNodeDelegatorCountReached();
        }

        for (uint256 i; i < length;) {
            UtilLib.checkNonZeroAddress(nodeDelegatorContracts[i]);
            nodeDelegatorQueue.push(nodeDelegatorContracts[i]);
            unchecked {
                ++i;
            }
        }
}

2. So if the admin adds same nodeDelegatorContract address twice to the queue, funds in that nodeDelegatorContract will be counted twice while calculating rsETH price.

uint256 ndcsCount = nodeDelegatorQueue.length;
        for (uint256 i; i < ndcsCount;) {
            assetLyingInNDCs += IERC20(asset).balanceOf(nodeDelegatorQueue[i]);
            assetStakedInEigenLayer += INodeDelegator(nodeDelegatorQueue[i]).getAssetBalance(asset);
            unchecked {
                ++i;
            }
        }

3. Due to this getRSETHPrice() function will return incorrect price.

Tools Used

Recommended Mitigation Steps

Add a check for duplicates in addNodeDelegatorContractToQueue() function.

Assessed type

Invalid Validation