araj - stEth:transferFrom() transfers 1-2 wei less than the actual amount

[sherlock-admin2]

araj

Medium

stEth:transferFrom() transfers 1-2 wei less than the actual amount

Summary

stEth:transferFrom() transfers 1-2 wei less than the actual amount due to rounding down. Read more

Vulnerability Detail

When a user deposits stEth using Vault::deposit(), it transfers the actualAmount from user to address(this) using safeTransferFrom()

           IERC20(tokens[i]).safeTransferFrom(
                msg.sender,
                address(this),
                amount
            );
            actualAmounts[i] = amount;

stETH uses shares for tracking balances and it is a known issue that due to rounding error, transferred shares may be 1-2 wei less than amount passed in transferFrom().

Now the problem is this actualAmount is directly passed to depositCallback(), as result this call will revert or not work as intended because there is 1-2 wei less stEth than actualAmount

        address callback = configurator.depositCallback();
        if (callback == address(0)) return (actualAmounts, lpAmount);
   @>     IDepositCallback(callback).depositCallback(actualAmounts, lpAmount);

Impact

Deposit can be DoS

Code Snippet

https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/Vault.sol#L329C11-L334C39
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/Vault.sol#L340C7-L342C77

Tool used

Manual Review

Recommendation

Check balance before and after calling safeTransferFrom() for actual amount transfered

Duplicate of #299