Vault:deposit should transfer the amount assets and not shares.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Vault.sol#L167

Vulnerability details

Impact

The wrong amount can be transferred from the msg.sender to the Vault.

Proof of Concept

When Vault:deposit is called, it is supposed to get assets amount of asset from the msg.sender and send the msg.sender shares amount of the vault token.

However in the current implementation, the Vault would get shares amount of asset from the msg.sender. See line 167 from the snippet below.

The assets and shares are not necessarily the same amount. Therefore the Vault might transfer the wrong amount of asset from the msg.sender.

// Vault
// deposit
165        require((shares = previewDeposit(id, assets)) != 0, "ZeroValue");
166
167        asset.transferFrom(msg.sender, address(this), shares);
168
169        _mint(receiver, id, shares, EMPTY);

Tools Used

None

Recommended Mitigation Steps

// Vault
// deposit
167        asset.transferFrom(msg.sender, address(this), assets);

[3xHarry]

dup #471

[HickupHH3]

warden's primary QA