Liquid Staking

Summary

VaultControllerStrategy.sol#deposit() will always fail if someone send some tokens to address(this) deliberately.

Vulnerability Details

In deposit(), tokens will be transferred from msg.sender to address(this), then those tokens will be deposited to vaults. However, when deposit to vaults, "token.balanceOf(address(this))" is used instead of "_amount". If someone send some tokens to address(this) deliberately, token.balanceOf(address(this)) > amount, then deposited > _amount. "_amount - deposited" will underflow, cause deposit() to revert.

Impact

VaultControllerStrategy.sol#deposit() will always fail if someone send some tokens to address(this) deliberately

Tools Used

manually reviewed

Recommendations

Two modification methods, (1) seems better.

(1)

uint256 deposited = _depositToVaults(startIndex, token.balanceOf(address(this)), vaultMinDeposits, vaultMaxDeposits);

change to

uint256 deposited = _depositToVaults(startIndex, _amount, vaultMinDeposits, vaultMaxDeposits);

(2),

if (deposited != _amount) {
token.safeTransfer(address(stakingPool), _amount - deposited);
}

change to:

if (deposited < _amount) {
token.safeTransfer(address(stakingPool), _amount - deposited);
}