Lendgine.mint doesn't return overpaid collateral

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L71-L102

Vulnerability details

Impact

Lendgine.mint doesn't return overpaid collateral and doesn't provide more liquidity for him.

Proof of Concept

When borrower wants to get liquidity from the pool he calls Lendgine.mint function.
https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L71-L102

  function mint(
    address to,
    uint256 collateral,
    bytes calldata data
  )
    external
    override
    nonReentrant
    returns (uint256 shares)
  {
    _accrueInterest();


    uint256 liquidity = convertCollateralToLiquidity(collateral);
    shares = convertLiquidityToShare(liquidity);


    if (collateral == 0 || liquidity == 0 || shares == 0) revert InputError();
    if (liquidity > totalLiquidity) revert CompleteUtilizationError();
    // next check is for the case when liquidity is borrowed but then was completely accrued
    if (totalSupply > 0 && totalLiquidityBorrowed == 0) revert CompleteUtilizationError();


    totalLiquidityBorrowed += liquidity;
    (uint256 amount0, uint256 amount1) = burn(to, liquidity);
    _mint(to, shares);


    uint256 balanceBefore = Balance.balance(token1);
    IMintCallback(msg.sender).mintCallback(collateral, amount0, amount1, liquidity, data);
    uint256 balanceAfter = Balance.balance(token1);


    if (balanceAfter < balanceBefore + collateral) revert InsufficientInputError();


    emit Mint(msg.sender, collateral, shares, liquidity, to);
  }

This function calculates amount of liquidity that will be borrowed to the caller, mints him propotional amount of shares and then calls IMintCallback in order to receive collateral from user.
if (balanceAfter < balanceBefore + collateral) revert InsufficientInputError();
This is how amount received from user is checked. It's possible that user will pay more collateral actually. And in this case nothing is sent back to him and also he doesn't receive more liquidity and shares.

Tools Used

VsCode

Recommended Mitigation Steps

Do not allow user to pay more then collateral amount.

[c4-judge]

berndartmueller marked the issue as duplicate of #174

[c4-judge]

berndartmueller marked the issue as satisfactory