# Protocol mints less rsETH on deposit than intended

Kelp DAO depositAsset transfers tokens before computing rsETH price, so depositors receive fewer rsETH than intended due to inflated totalEthLocked.

- Payout: Contest reward
- Severity: high
- Program: Kelp DAO
- Credited: T1MOH
- Disclosed: 2023-12-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-kelp-findings/issues/62
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-kelp%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** LRT deposit contract (depositAsset / rsETH minting oracle)
**Root cause:** depositAsset calls transferFrom before _mintRsETH; getTotalAssetDeposits reads IERC20(asset).balanceOf(address(this)), so the just-deposited amount inflates totalEthLocked and thus rsEthPrice, shrinking rsethAmountToMint.
**Steps:**
1. Set state: totalEthLocked=10e18, assetPrice=1e18, rsETHSupply=10e18
2. Call `depositAsset(asset, 30e18)`
3. Contract executes `transferFrom(msg.sender, address(this), 30e18)` first
4. `_mintRsETH` -> `getRsETHAmountToMint` -> `LRTOracle.getRSETHPrice` -> `getTotalAssetDeposits` reads balanceOf = 40e18
5. rsEthPrice = 40e18/10e18 = 4e18; minted = 30e18*1e18/4e18 = 7.5e18 instead of 30e18
**How found:** Code-reading of the deposit flow: noticed transferFrom occurs before _mintRsETH, then traced the call chain to getAssetDistributionData which uses live balanceOf, revealing the ordering dependency.
**Exploitation:** Any depositor triggers the mispricing on every deposit; the deposit itself inflates the price used for its own mint, so the user silently receives a fraction of the rsETH owed, causing direct fund loss to the depositor.
**Insight:** When a share/price oracle reads live token balances, check whether the deposit transfer happens before the mint calculation; any balance-based pricing must be snapshotted pre-transfer or the deposit self-dilutes its own mint.