den_sosnovskyi - IERC20(stEth).safeTransferFrom will 1-2 wei less than expected due to the stEth 1-2 wei corner case

[sherlock-admin2]

den_sosnovskyi

Medium

IERC20(stEth).safeTransferFrom will 1-2 wei less than expected due to the stEth 1-2 wei corner case

Summary

DepositWrapper::deposit will revert if depositing steth.

Vulnerability Detail

stEth has a 1-2 wei corner case, accordingly to which, 1-2 wei less will be transfered than expected. After IERC20(steth).safeTransferFrom(sender, wrapper, amount) we call IERC20(steth).safeIncreaseAllowance(wsteth, amount). Because of the loss of 1-2 wei, we will not have 'amount' of steth, we will have 'amount - 1 or 2 wei', so we cannot allow and wrap 'amount' quantity of stEth

Impact

DepositWrapper::deposit will revert for steth depositing

Code Snippet

https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/utils/DepositWrapper.sol#L56-L57
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/utils/DepositWrapper.sol#L35-L39

Tool used

Manual Review

Recommendation

Use transferShares function

Duplicate of #299

[recursiveEth]

Escalate
the loss of 1-2 WEI is not a low/invalid issue, the same issue has been considered in past audits as well thank you

[sherlock-admin3]

Escalate
the loss of 1-2 WEI is not a low/invalid issue, the same issue has been considered in past audits as well thank you

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[z3s]

#181

[WangSecurity]

Escalation on #276 will be the main one for #299 issue family, this escalation will be rejected since it doesn't have any value and is basically the same one from the same person.

[WangSecurity]

Result:
Invalid
Duplicate of #299

[sherlock-admin4]

Escalations have been resolved successfully!

Escalation status:

• recursiveEth: rejected