TrungOre - Users can bypass the fee when depositing in the vault

[sherlock-admin]

TrungOre

medium

Users can bypass the fee when depositing in the vault

Summary

Users can bypass the fee when depositing in the vault by using the function mintDepositInQueue

Vulnerability Detail

Users have 2 options to deposit into a vault. The first option lets the users specify a particular epochId and the protocol will charge a percentage of _assets. The second one allows users not to define which epochId they want to deposit in and gives this duty to the relayer who can be anyone to choose the epochId that the users will be minted the shares. After that, the relayer can take relayerFee ETH as a fee to process the transaction.

function _deposit(
    uint256 _id,
    uint256 _assets,
    address _receiver
) internal {
    // mint logic, either in queue or direct deposit
    if (_id != 0) {
        uint256 assetsToDeposit = _assets;

        if (depositFee > 0) {
            (uint256 maxX, , uint256 minX) = getEpochConfig(_id);
            uint256 fee = _calculateFeePercent(int256(minX), int256(maxX));
            uint256 feeAmount = _assets.mulDivDown(fee, 10000);
            assetsToDeposit = _assets - feeAmount;
            _asset().safeTransfer(treasury, feeAmount);
        }

        _mintShares(_receiver, _id, assetsToDeposit);

        emit Deposit(msg.sender, _receiver, _id, _assets);
    } else {
        depositQueue.push(
            QueueItem({assets: _assets, receiver: _receiver, epochId: _id})
        );

        emit DepositInQueue(msg.sender, _receiver, _id, _assets);
    }

The relayer processes the transactions by calling the function Carousel.mintDepositInQueue() to mint the shares corresponding to each element in the array depositQueue. Note that the depositQueue is executed in FILO order (from the array's tail to the head). This execution order creates a flaw in the "taking fee mechanism" which let the users deposit in the expected epochId without paying any fee.

For example,

1. Alice wants to deposit x ETH in the vault with epochId = 4.
2. Alice calls Carousel.deposit(_id = 0, _assets = (x + relayerFee) ETH, _receiver = Alice).
   Because Alice set the _id = 0, the deposit will be added to the tail of the depositQueue array.
3. Alice immediately calls Carousel.mintDepositInQueue(_epochId = 4, operations = 1). As we can see that Alice is the relayer in this function call, then she can gain x - relayer shares of the epochId = 4 and get back the relayerFee ETH.

Note that Alice can write a smart contract to execute step 2 and step 3 in the same transaction which helps her bypass the deposit fee.

Impact

Users can bypass the deposit fee.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L354
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L495-L497

Tool used

Manual Review

Recommendation

Consider sending a portion of relayerFee to treasury instead of transferring all of the fees for msg.sender.

Duplicate of #75