Submitted by web3km, also found by asui, Eeyore, 0xMax1mus, Spearmint, boraichodrunkenmaster, zhaojohnson, peanuts, lian886 (1, 2), Infect3d, yashar, emmac002, Walter, Afriauditor, zhaojie (1, 2), 0xpiken, grearlake, Breeje, 0xAadi, hash, pkqs90, and nnez
https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/StakingLPEth.sol#L141-L144
https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/StakingLPEth.sol#L71
https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/StakingLPEth.sol#L112
The last user that tries to cooldown/withdraw his share will not be able to withdraw the full deposited amount.
The StakingLpEth contract implements a check for minimum shares to ensure that inflation attacks cannot happen:
The _checkMinShares function is called on every deposit/withdrawal to ensure that _totalSupply does not become less than MIN_SHARES:
However, this check opens up a griefing opportunities for attackers to either make sure that the last user that tries to withdraw will only be able to withdraw (his balance - MIN_SHARES) locking the MIN_SHARES with no way of getting them out or completely DoSing the deposit/mint functionality of the vault.
Locking funds for the last user that withdraws/cooldowns:
DoS of deposit/mint functionality:
The contract calculates the share the same way as every ERC4626 contract:
Since decimalsOffset() == 0 and totalAssets() will equal to the balance of lpEth in the contract.
The calculation will be:
f(share) = (lpEth * totalSupply + 1) / (totalLpEth() + 1)
(1000e18 * 0 + 1) / (0.01e18 + 1) = $100000
Which is less than MIN_SHARES, which ultimately makes the function revert. The user will have to deposit 100_000_000_000_000 lpEth in order to pass the minimum shares requirement.
Consider funding the contract in the deployment script and remove the MIN_SHARES check to ensure that no DoS or locking of funds is possible.
Error
0xtj24 (LoopFi) acknowledged and commented:
Koolex (judge) decreased severity to Medium
Note: For full discussion, see here.
