Summary

The depositIntoVault function lacks slippage protection, which can result in differences between the expected and actual amounts deposited.

Vulnerability Details

The function deposits staked ETH into the WETH Steak vault without accounting for potential slippage. As a result, the actual WETH amount received may differ from the anticipated amount, leading to inconsistencies in the number of shares allocated to the user.

Impact

Without slippage protection, the system is vulnerable to front-running or sandwich attacks. Malicious entities could exploit this weakness to manipulate the deposit process, causing users to receive fewer shares than anticipated and potentially compromising the fairness of the deposit system.

Tools Used

Manual Code Review

Recommendations

Implement slippage protection mechanisms or verify the deposited amount against the actual received amount to ensure consistency and equity in share allocation.