0xShoonya - Lido 1-2 wei transfer issue

[sherlock-admin2]

0xShoonya

High

Lido 1-2 wei transfer issue

Summary

Vulnerability Detail

When user calls deposit and token is steth, the amount param passed by the user is utilized in IERC20(steth).safeTransferFrom(sender, wrapper, amount) and transferred to the contract.

 if (token == steth) {
    IERC20(steth).safeTransferFrom(sender, wrapper, amount); 
    amount = _stethToWsteth(amount);

The vulnerability here is that protocol always assumes that the amount of tokens received is equal to the amount of tokens transferred.
This is not the case for rebasing tokens, such as stETH, because internally they transfer shares which generally results in the received amount of tokens being lower than the requested one by a couple of wei because of roundings. This is a known high severity issue.

Wrapping to wsteth will revert, because the contract doesn't have enough stETH.

 function _stethToWsteth(uint256 amount) private returns (uint256) {
        IERC20(steth).safeIncreaseAllowance(wsteth, amount);
        IWSteth(wsteth).wrap(amount);steth- reverts
        return IERC20(wsteth).balanceOf(address(this));
    }

Impact

deposit()function will revert

Code Snippet

https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/utils/DepositWrapper.sol#L42-L75

Tool used

Manual Review

Recommendation

Use lido recommendation to utilize transferShares function, so the _amount is realistic, or implement FoT approach, which compares the balance before and after the transfer.

Duplicate of #299