VAD37 - LMPVaultRouterBase mint and deposit function unintended pulling WETH from user when using only ETH

[sherlock-admin]

VAD37

high

LMPVaultRouterBase mint and deposit function unintended pulling WETH from user when using only ETH

Summary

The LMPVaultRouterBase contract unintentionally takes WETH from users who send ether to mint/deposit.
Due to this, the excess WETH remains stuck in the router. Anyone can take these stucked WETH.

Vulnerability Detail

1. When a user calls the deposit() function, which is a payable method, any ether (msg.value) is converted to WETH.

2. Simultaneously, the function pullToken() fetches the vaultAsset (WETH) from the user, which is WETH determined by LMPVault.asset().

3. The issue arises as the LMPVault accepts WETH only from the amount pulled from the user, neglecting the ether the user sent to the payable function. Consequently, any unutilized ether remains stranded in the router contract.

4. Given the router contract's PeripheryPayments sweep function, this stranded WETH can be taken by anyone.

Impact

Router mint and deposit payable function does not process ETH transfered in to vault so _processEthIn() does nothing.
Any user use ETH to deposit/mint will be stucked in router contract and can be stolen by anyone.

Code Snippet

https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L29-L33
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L51

Tool used

Manual Review

Recommendation

• Eliminate the payable attribute from the mint/deposit functions.
• Relocate _processEthIn() to an individual function and employ multicall for executing both functions in a single transaction.

Duplicate of #1