0xComfyCat - LMPVaultRouterBase incorrectly handle WETH transfer

[sherlock-admin]

0xComfyCat

medium

LMPVaultRouterBase incorrectly handle WETH transfer

Summary

Vulnerability Detail

Supplying ETH via msg.value doesn't work since native ETH gets wrapped by internal function _processEthIn then it will attempt to transfer WETH from user via pullToken which result in the assets being transfer twice (both ETH and WETH)

Impact

Incorrect implementation causes contract to not function properly and initial ETH sent will be stuck in router contract

Code Snippet

        // handle possible eth
        _processEthIn(vault);  // @audit - ETH being wrapped

        IERC20 vaultAsset = IERC20(vault.asset());
        uint256 assets = vault.previewMint(shares);
        pullToken(vaultAsset, assets, address(this));  // @audit - WETH being transferred in

https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/main/src/vault/LMPVaultRouterBase.sol#L29-L35

Tool used

Manual Review

Recommendation

skip pull WETH if WETH balance in contract as a result of wrapping is enough for assets amount

Duplicate of #1