zhuying - depositing stETH will revert beacuse the amount transfered does not equal the amount received in many cases for stETH

[sherlock-admin4]

zhuying

High

depositing stETH will revert beacuse the amount transfered does not equal the amount received in many cases for stETH

Summary

Depositing stETH will revert beacuse the amount transfered does not equal the amount received in many cases for stETH.

Vulnerability Detail

stETH balance calculation includes integer division, and there is a common case when the whole stETH balance can't be transferred from the account while leaving the last 1-2 wei on the sender's account.

The process of depositing stETH is as follows:

1. Transfer stETH from depositor to deposit wrapper contract.

IERC20(steth).safeTransferFrom(sender, wrapper, amount);

2. Wrap stETH to wstETH.

IWSteth(wsteth).wrap(amount);

Because the amount in step 2 is equal to the amount in step 1 and the actual amount in deposit wrapper contract is smaller than the wrap amount, depositing stETH will revert.

Impact

Depositing stETH will revert.

Code Snippet

https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/utils/DepositWrapper.sol#L55-L57
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/utils/DepositWrapper.sol#L35-L39

Tool used

manual

Recommendation

The input of _stethToWsteth is set as IERC20(steth).balanceOf(address(this)).

Duplicate of #299