Steadefi

Summary

The amount of LP-tokens to withdraw is calculated at the GMXWithdraw.withdraw before the mintFee function is called. The mintFee function increases the totalSupply amount. This way users receive more tokens than should be at the current timestamp. The longer the period since the last mintFee was called the more excess tokens the user receives.

Vulnerability Details

The protocol mints vault token shares as management fees to protocol treasury with the mintFee function. This increases the totalSupply of the shares. The amount of minted fees depends on the time since the last mintFee call.

While withdrawal amount of LP-token can be calculated with outdated totalSupply:

The mintFee is called only after this calculation.

Impact

Users can receive excess amounts of tokens during withdrawal. Other users and the protocol management lose value of their shares.

Tools used

Manual Review

Recommendations

Consider calling the mintFee before the _wc.shareRatio calculation.