Sparrow_Jac - Protocol supports stETH but doesn't consider its unique transfer logic which would lead to overvaluation of deposited assets

[sherlock-admin4]

Sparrow_Jac

High

Protocol supports stETH but doesn't consider its unique transfer logic which would lead to overvaluation of deposited assets

Summary

The StakingModule contract handles staking operations by converting weth to stETH and wstETH. However, a subtle issue arises from the "1-2 wei corner case" with stETH transfers, where the amount transferred can be slightly less than specified. This discrepancy can lead to overvaluation of deposited assets and flawed logic in subsequent operations.

Vulnerability Detail

The core issue lies in the _wethToWSteth function, which does not account for the exact amount of stETH received after converting weth. Due to a known "1-2 wei corner case" in stETH transfers, the actual amount received can be less than expected, causing miscalculations in asset values. This leads to an overvaluation of deposited stETH when passed into other functions that rely on exact amounts.
For added context/ reference, take a look at:

• https://docs.lido.fi/guides/lido-tokens-integration-guide/#1-2-wei-corner-case
• Account's stETH balance getting lower on 1 or 2 wei due to rounding down integer math lidofinance/core#442

Impact

This discrepancy can cause several issues:

• Overvaluation: The protocol may overvalue the deposited assets, leading to imprecise calculations in various staking and withdrawal operations.
• Boost Logic Flaws: If the protocol allows boosting based on deposited amounts, the overvaluation could allow users to boost more than they should be able to, leading to potential financial imbalances.

Code Snippet

The current implementation of _wethToWSteth does not handle the exact amount of stETH received:
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/modules/obol/StakingModule.sol#L77-L83

Tool used

Manual Review

Recommendation

To mitigate this issue, modify _wethToWSteth to check and use the exact amount of stETH received:

function _wethToWSteth(uint256 amount) private {
    IWeth(weth).withdraw(amount);
    
    uint256 initialStethBalance = IERC20(steth).balanceOf(address(this));
    ISteth(steth).submit{value: amount}(address(0));
    uint256 receivedSteth = IERC20(steth).balanceOf(address(this)) - initialStethBalance;
    
    IERC20(steth).safeIncreaseAllowance(address(wsteth), receivedSteth);
    IWSteth(wsteth).wrap(receivedSteth);
}

Duplicate of #299