Stormy - The system doesn't account the staked balances of previously used asset strategies, as a result the RSETH exchange rate will be calculated based on wrong values and slightly undervalued than it should be.
Audit: 2023-11-kelp-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTOracle.sol#L52-L79


# Vulnerability details

## Impact
The system doesn't account the staked balances of previously used asset strategies, as a result the RSETH exchange rate will be calculated based on wrong values and slightly undervalued than it should be.

## Proof of Concept
Currently EigenLayer supports only three tokens stETH, rETH and cbETH, every one of them have an allocated strategy for use. As time passes any of this asset strategies can potentially be replaced with new ones, which is why the function updateAssetStrategy is implemented in the system to correctly account if this ever happens.
```solidity
    function updateAssetStrategy(
        address asset,
        address strategy
    )
        external
        onlyRole(DEFAULT_ADMIN_ROLE)
        onlySupportedAsset(asset)
    {
        UtilLib.checkNonZeroAddress(strategy);
        if (assetStrategy[asset] == strategy) {
            revert ValueAlreadyInUse();
        }
        assetStrategy[asset] = strategy;
    }
```
However changing the asset strategy can mess up the accounting of the RSETH exchange rate:

- On a short explanation, when rsEthSupply != 0 the system is supposed to manually calculate the exchange rate of the RSETH token based on the staked values received from EigenLayer for the supported assets used. Currently the system uses the function getTotalAssetDeposits and accounts all the asset balances of the deposit pool, all of the node delegator contracts and all of the allocated strategies set in the mapping assetStrategy, this is correct and might work when the given strategies for an asset never changed before but if they does, it will be a problem as the previously used strategies will still hold funds as there is no redeem feature in kelp dao, duo to that the staked values of previously used strategies need to be accounted towards the correct calculation of the RSETH exchange rate. 

```solidity
    function getRSETHPrice() external view returns (uint256 rsETHPrice) {
        address rsETHTokenAddress = lrtConfig.rsETH();
        uint256 rsEthSupply = IRSETH(rsETHTokenAddress).totalSupply();

        if (rsEthSupply == 0) {
            return 1 ether;
        }

        uint256 totalETHInPool;
        address lrtDepositPoolAddr = lrtConfig.getContract(LRTConstants.LRT_DEPOSIT_POOL);

        address[] memory supportedAssets = lrtConfig.getSupportedAssetList();
        uint256 supportedAssetCount = supportedAssets.length;

        for (uint16 asset_idx; asset_idx < supportedAssetCount;) {
            address asset = supportedAssets[asset_idx];
            uint256 assetER = getAssetPrice(asset);

            uint256 totalAssetAmt = ILRTDepositPool(lrtDepositPoolAddr).getTotalAssetDeposits(asset);
            totalETHInPool += totalAssetAmt * assetER;

            unchecked {
                ++asset_idx;
            }
        }

        return totalETHInPool / rsEthSupply;
    }
```

- C