Kelp DAO | rsETH - debo's results

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/c5fdc2e62c5e1d78769f44d6e34a6fb9e40c00f0/src/NodeDelegator.sol#L35-L46

Vulnerability details

Impact

The function maxApproveToEigenStrategyManager was detected to be using the maximum value for the approval amount in the NodeDelegator contract. This is a malicious behavior and should be discouraged.

Proof of Concept

Vulnerable maxApproveToEigenStrategyManager function

    /// @notice Approves the maximum amount of an asset to the eigen strategy manager
    /// @dev only supported assets can be deposited and only called by the LRT manager
    /// @param asset the asset to deposit
    function maxApproveToEigenStrategyManager(address asset)
        external
        override
        onlySupportedAsset(asset)
        onlyLRTManager
    {
        address eigenlayerStrategyManagerAddress = lrtConfig.getContract(LRTConstants.EIGEN_STRATEGY_MANAGER);
        IERC20(asset).approve(eigenlayerStrategyManagerAddress, type(uint256).max);
    }

Tools Used

VS Code.

Recommended Mitigation Steps

Change the amount to be approved to a smaller amount. And utilise safeIncreaseAllowance or safeDecreaseAllowance.

Assessed type

Token-Transfer