Ethena Labs - csanuragjain's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L237

Vulnerability details

Impact

User will not be able to Withdraw their own funds.

Proof of Concept

1. Lets say User A deposited assets which gave him 1 ether shares
2. User B and User C deposited assets worth 0.5 ether and 0.4 ether each
3. 2nd step passes the _checkMinShares check since totalSupply(1+0.5+0.4) > MIN_SHARES (1 ether)

function _checkMinShares() internal view {
    uint256 _totalSupply = totalSupply();
    if (_totalSupply > 0 && _totalSupply < MIN_SHARES) revert MinSharesViolation();
  }

4. Now User A withdraws all his shares which is 1 ether
5. User B tries withdrawing his 0.5 ether shares but fails due to _checkMinShares check
6. This happens since totalSupply(0.5+0.4) < MIN_SHARES (1 ether)
7. So both User B and User C are stuck
8. However this is temporary since any of these Users can deposit the lagging amount and then withdraw their funds. Like in this case User B can deposit funds worth 0.1 ether and withdrawal will work since MIN_SHARES is now reached

Tools Used

Manual analysis

Recommended Mitigation Steps

The min share check is kept to prevent donation attack. Instead of using current design, protocol could follow the trick used by Uniswap. On the very first deposit, a very small amount 10^3 (deducted from User deposit) could be minted to 0 address, making the donation attack infeasible

Assessed type

Invalid Validation