Ethena Labs - kkkmmmsk's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L225-L238

Vulnerability details

Impact

If one person left 1wei in StakedUSDe, and the last withdrawal cannot be fully withdrawn.

Proof of Concept

For example, stakerA left 1 wei share in StakedUSDe, and after the last withdrawal totalSupply=1 wei,

it will revert MinSharesViolation, and last withdrawal fails. So the last withdrawal must left 1 ether

share in StakedUSDe contract, and can not withdraw all shares.

  function _withdraw(address caller, address receiver, address _owner, uint256 assets, uint256 shares)
    internal
    override
    nonReentrant
    notZero(assets)
    notZero(shares)
  {
    if (hasRole(FULL_RESTRICTED_STAKER_ROLE, caller) || hasRole(FULL_RESTRICTED_STAKER_ROLE, receiver)) {
      revert OperationNotAllowed();
    }

    super._withdraw(caller, receiver, _owner, assets, shares);
    _checkMinShares();
  }

  function _checkMinShares() internal view {
    uint256 _totalSupply = totalSupply();
    if (_totalSupply > 0 && _totalSupply < MIN_SHARES) revert MinSharesViolation();
  }

Tools Used

Manual Review

Recommended Mitigation Steps

remove _checkMinShares in _withdraw function

Assessed type

ERC4626