# Update in strategy will cause wrong issuance of shares

Kelp's updateAssetStrategy leaves old-strategy balances uncounted, dropping rsETH share price so new depositors mint excess shares.

- Payout: Contest reward
- Severity: medium
- Program: Kelp DAO
- Credited: crack-the-kelp
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-kelp-findings/issues/197
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-kelp%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** LRTConfig.updateAssetStrategy / NodeDelegator.getAssetBalance / LRTOracle
**Root cause:** updateAssetStrategy only rewrites assetStrategy[asset] without migrating or accounting for funds in the old strategy; NodeDelegator.getAssetBalance reads only the current strategy, so getTotalAssetDeposits drops.
**Steps:**
1. Deploy LRTConfig, LRTDepositPool, LRTOracle, NodeDelegator; set stETH strategy to mockStrategy1.
2. Alice deposits 10 stETH via `lrtDepositPool.depositAsset(stETH, 10 ether)` -> mints 10e18 rsETH.
3. Manager calls `transferAssetToNodeDelegator(0, stETH, 10 ether)` moving funds into strategy1.
4. Admin calls `lrtConfig.updateAssetStrategy(stETH, mockStrategy2)` (and rETH, cbETH).
5. Alice deposits another 10 stETH; getTotalAssetDeposits now excludes strategy1 balance, so 2.5e18 rsETH minted instead of ~10e18.
**How found:** Code reading of getTotalAssetDeposits -> NodeDelegator.getAssetBalance, noticing it queries only the currently configured strategy, then testing a strategy swap in Foundry.
**Exploitation:** Attacker waits for/observes a strategy update, then deposits into LRTDepositPool; reduced totalDeposits lowers rsETH price, minting more shares than the deposit is worth, diluting existing holders.
**Insight:** In vault/share accounting, trace every path that reads 'total assets' and check whether any admin setter (strategy, oracle, queue) can make that read diverge from actual held funds; strategy/address swaps are a classic share-price manipulation trigger.