A MALICIOUS WHALE CAN `DoS` THE ASSET DEPOSIT FUNCTIONALITY OF THE `LRTDepositPool` CONTRACT BY DIRECLTY TRANSFERRING A LARGE AMOUNT OF RESPECTIVE TOKENS TO THE PROTOCOL
Audit: 2023-11-kelp-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L132-L134
https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L56-L58
https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L47-L51
https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L79
https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTDepositPool.sol#L83


# Vulnerability details

## Impact

The `LRTDepositPool.depositAsset` function is used to allow user to deposit particular asset amount to the `LRTDepositPool` contract. In the `depositAsset` function there is a deposit limit check as shown below:

        if (depositAmount > getAssetCurrentLimit(asset)) { //@audit-info - deposit amount should not exceed current avaialble limit
            revert MaximumDepositLimitReached();
        }

The above check ensures that the `depositAmount` of the `msg.sender` should not exceed the currently available deposit limit of the asset. The function logic of the `LRTDepositPool.getAssetCurrentLimit` is shown below:


    function getAssetCurrentLimit(address asset) public view override returns (uint256) {
        return lrtConfig.depositLimitByAsset(asset) - getTotalAssetDeposits(asset); //@audit-info - get current available limit of asset deposit
    }

The above `getTotalAssetDeposits` function call gets the currently deposited asset amounts in `deposit pool`, `all node delegator contracts` and `eigenlayer` as shown below;

    function getTotalAssetDeposits(address asset) public view override returns (uint256 totalAssetDeposit) { //@audit-info - return teh total assets present in the protocol
        (uint256 assetLyingInDepositPool, uint256 assetLyingInNDCs, uint256 assetStakedInEigenLayer) =
            getAssetDistributionData(asset);
        return (assetLyingInDepositPool + assetLyingInNDCs + assetStakedInEigenLayer); //@audit-info - add the asset amounts lying in each of the above three places and return it
    }

The deposited asset amounts in each of the above contracts are calculated in the `LRTDepositPool.getAssetDistributionData` function as shown below:

        assetLyingInDepositPool = IERC20(asset).balanceOf(address(this)); //@audit-info - get the balance of the asset in this contract

        uint256 ndcsCount = nodeDelegatorQueue.length; //@audit-info - nodeDelegatorQueue is an address array and its length is taken here
        for (uint256 i; i < ndcsCount;) { //@audit-info - loop through the node delegators
            assetLyingInNDCs += IERC20(asset).balanceOf(nodeDelegatorQueue[i]); //@audit-info - add up the asset balances in each of the node delegators
            assetStakedInEigenLayer += INodeDelegator(nodeDelegatorQueue[i]).getAssetBalance(asset); //@audit-info - add up the assets staked in the eigen layer by the node delegator addresses
            unchecked {
                ++i;
            } //@audit-info - increment the i
        }

The issue here is