Submitted by T1MOH, also found by 0xepley, SBSecurity, cryptothemex, adriro, AlexCzm, trachev, adam-idarrha, Aymen0909, deepplus, xAriextz, ast3ros, Weed0607, DanielArmstrong, rouhsamad, osmanozdemir1, GREY-HAWK-REACH, 0x1337, zhaojie, Jiamin, crunch, Varun_05, 7siech, QiuhaoLi, circlelooper, HChang26, Juntao, ayden, Aamir, rvierdiiev, max10afternoon, crack-the-kelp, Ruhum, 0xluckhu, 0xNaN, mahdirostami, and 0xmystery
Price of rsETH is calculated as totalLockedETH / rsETHSupply. rsETH price is used to calculate rsETH amount to mint when user deposits. Formulas are following:
Problem is that it transfers deposit amount before calculation of rsethAmountToMint. It increases totalEthLocked. As a result rsethAmountToMint is less than intended because rsEthPrice is higher.
For example:
Here you can see that it firstly transfers asset to address(this), then calculates amount to mint:
There is long chain of calls:
Finally getTotalAssetDeposits() uses current balanceOf(), which was increased before by transferring deposit amount:
Transfer tokens in the end:
Oracle
RaymondFam (lookout) commented:
gus (Kelp) confirmed and commented:
0xDjango (judge) commented:
