ElKu - Treasury doesn't get depositFee when user deposits into epochs using the zero epoch method

[sherlock-admin]

ElKu

medium

Treasury doesn't get depositFee when user deposits into epochs using the zero epoch method

Summary

In Carousel contract, depositFee is charged only when the users deposit to an epoch directly, specifying the correct epochId. If the deposit happens via the epochId of zero, treasury doesnt get the deposit fee and only relayer benefits. This causes loss to the protocol.
Also the protocol is not able to enforce the rule of increasing depositFee on deposits closer to the epoch begin time.

Vulnerability Detail

There are two ways to deposit tokens into an epoch.

1. By calling the deposit or depositETH function by mentioning a non-zero _id which corresponds to the specific epochId which you want to deposit your tokens into.
2. By calling the deposit or depositETH function by mentioning a zero _id. In this case the deposited tokens are queued into an array and a relayer, will add these funds for you, on your behalf, into the next available epoch.

In the first case of direct deposit, a deposit fee (of maximum 2.5%) is charged by the contract and sent to the treasury address.
In the second case of indirect deposit, there is no deposit fee charged and so, the treasury doesn't benefit from the deposit. Instead, the relayer who is processing the deposit queue gets a fee called relayerFee.

This causes loss to the protocol treasury.

Impact

Protocol treaury losses depositFee as depositors use the zero epochId method to deposit into epochs.

Also the deposit fee is supposed to be linearly increasing as the user deposits close to the beginning of the epoch. If there is no deposit fee charged on the deposit, then users can avoid this fee and do their deposits in the last block before the beginning of the epoch without encountering any additional fees.

Code Snippet

Parts of the _deposit function which deals with the depositFee for epochId > 0 and the part where the deposit details are pushed into the depositQueue for epochId = 0.

    function _deposit(
        uint256 _id,
        uint256 _assets,
        address _receiver
    ) internal {
        // mint logic, either in queue or direct deposit
        if (_id != 0) {
            uint256 assetsToDeposit = _assets;

            if (depositFee > 0) {
                uint256 feeAmount = _assets.mulDivDown(fee, 10000);
                assetsToDeposit = _assets - feeAmount;
                _asset().safeTransfer(treasury, feeAmount);
            }
        } else {
            depositQueue.push(
                QueueItem({assets: _assets, receiver: _receiver, epochId: _id})
            );

The part where relayerFee is sent to the relayer for processing the deposit queue. This is from the mintDepositInQueue function.

asset.safeTransfer(msg.sender, _operations * relayerFee);

Tool used

Manual Review, VSCode.

Recommendation

The deposit fee should be charged in all cases.

Duplicate of #75