lemonmon - Too many assets may be pulled from the user when they deposit or mint into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit()

[sherlock-admin2]

lemonmon

medium

Too many assets may be pulled from the user when they deposit or mint into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit()

Summary

LMPVaultRouterBase.mint() and LMPVaultRouterBase.deposit() both may pull too many assets from the user, if the user sends ETH via msg.value.

Vulnerability Detail

When a user is calling LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit() and they are sending ETH via msg.value, the protocol may pull too many assets from the user:

1. LMPVaultRouterBase._processEthIn() is called subsequently (line 51, line 30 LMPVaultRouterBase.sol), which deposits WETH for the LMPVaultRouter contract (line 120 LMPVaultRouterBase.sol) based on the msg.value which is the ETH the user sent to the contract.

2. Additionally PeripheryPayments.pullToken() gets called (line 54, line 34 LMPVaultRouterBase.sol), which transfers WETH from the user to the LMPVaultRouter contract, despite that the user already sent the necessary assets in ETH via msg.value.

Impact

The protocol might pull too many assets from the user due to this issue. First the protocol receives ETH via msg.value and then additionally the protocol also pulls WETH from the user, so that the user might have paid too many assets at the end.

A malicious actor may then steal these excess assets by calling PeripheryPayments.unwrapWETH9(), which unwraps all the WETH in the LMPVaultRouter and sends it to the recipient function parameter, so that the malicious actor receives the excess WETH assets from the victim user who depositted or minted before into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit() by sending ETH to the protocol via msg.value.

Code Snippet

https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L44-L57

https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L23-L41

https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L111-L122

https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/utils/PeripheryPayments.sol#L54-L56

https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/utils/PeripheryPayments.sol#L39-L48

Tool used

Manual Review

Recommendation

Consider adjusting LMPVaultRouterBase.mint() and LMPVaultRouterBase.deposit() to account for the ETH that the user sent via msg.value to the protocol, so that the protocol doesn't pull too many assets from the user.

Duplicate of #1