sandy - Steth::transferfrom will transfer 1-2 wei less which will result in reverting of consequent functions because of not enough balance.

[sherlock-admin2]

sandy

High

Steth::transferfrom will transfer 1-2 wei less which will result in reverting of consequent functions because of not enough balance.

Summary

Steth::transferfrom will transfer 1-2 wei less which will result in reverting of consequent functions because of not enough balance.

Vulnerability Detail

The protocol always assumes that the amount of tokens received is equal to the amount of tokens transferred. This is not the case for rebasing tokens, such as stETH, because internally they transfer shares which generally results in the received amount of tokens being lower than the requested one by a couple of wei because of rounding.

The probability of this issue appearing is very high as mentioned here: lidofinance/core#442

In the DepositWrapper contract, deposit function is used to deposit specified tokens into the vault. One of the tokens is steth which is converted to wsteth before depositing.

    function deposit(
        address to,
        address token,
        uint256 amount,
        uint256 minLpAmount,
        uint256 deadline
    ) external payable returns (uint256 lpAmount) {
        address wrapper = address(this);
        address sender = msg.sender;
        address[] memory tokens = vault.underlyingTokens();
        if (tokens.length != 1 || tokens[0] != wsteth)
            revert InvalidTokenList();
        if (amount == 0) revert InvalidAmount();
        if (token == steth) {
            IERC20(steth).safeTransferFrom(sender, wrapper, amount);
            amount = _stethToWsteth(amount);
...

steth is then converted to wsteth here using the same amount:

    function _stethToWsteth(uint256 amount) private returns (uint256) {
        IERC20(steth).safeIncreaseAllowance(wsteth, amount);
        IWSteth(wsteth).wrap(amount);
        return IERC20(wsteth).balanceOf(address(this));
    }

The problem is if amount - 1/2 wei is passed to _stethToWsteth() function, it will revert due to insufficient funds as DepositWrapper contract doesn't hold any steth tokens.

Impact

deposit() function of DepositWrapper contract will revert resulting in all deposits reverting and contract functionality DoS. Thus, the high severity.

Code Snippet

https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/utils/DepositWrapper.sol#L56-L57

Tool used

Manual Review

Recommendation

Use the actual amount of tokens received instead of the amount specified as input. This can be done by implementing amount handling like for Fee on transfer tokens, which compares the balance before and after the transfer.

Duplicate of #299