Summary

When the depositIntoVault function is called, shares are minted to the msg.sender proportionally, but the internal state of the contract is not updated. Specifically, usersToStakes[msg.sender] and totalAmountStaked are not correctly adjusted.

Vulnerability Details

After ETH is deposited into the vault and converted to WETH, the function fails to update the usersToStakes and totalAmountStaked variables. This leads to inaccurate internal state management, as the aforementioned values are not reduced accordingly.

Impact

The failure to update the internal state allows a malicious user to drain the staked funds by depositing only the minimum stake amount. Here's a possible exploit scenario:

1. Alice, alongside other users, deposits the minimum stake amount.

2. After 4 weeks, Alice repeatedly calls depositIntoVault() and receives shares corresponding to other users' deposits.

PoC

Insert the following test into steaking-contracts/test/Steaking.t.sol:

Tools Used

Manual Code Review

Recommendations

Ensure that the usersToStakes and totalAmountStaked variables are properly updated after each successful deposit to maintain accurate records and prevent potential exploitation during share issuance.