Part 2

Summary

The deposit() function in the VaultRouterBranch contract may incorrectly validate the minimum shares (minShares) due to a mismatch in decimal representations. While minShares is expected to be in 18 decimals, the shares obtained from the vault may have a different decimal format. This discrepancy can lead to erroneous comparisons.

Vulnerability Details

In the deposit() function, users can specify a minShares parameter, which represents the minimum amount of index tokens (shares) they expect to receive from the deposit. The comment in the code states that this value is in 18 decimals.

When a user deposits assets into a vault, the function calculates the number of shares obtained from the deposit.

However, the number of shares returned may not necessarily be in 18 decimals. The actual decimal representation of these shares depends on the specific token's configuration (in this case, the vault.indexToken).

The function then proceeds to validate these calculated shares as follows:

Impact

If the shares obtained from the deposit are in a different decimal format (e.g., 6 decimals) than the minShares (which is expected to be in 18 decimals), the comparison between ctx.shares and minShares will be incorrect. For instance, if minShares is set to 100e18 (100 tokens in 18 decimals) but the obtained shares are in 6 decimals, this would lead to incorrect comparison.

Tools Used

Manual Review

Recommendations

Ensure that both values being compared are in the same decimal format. Converting the obtained shares (ctx.shares) to 18 decimals before performing the comparison with minShares.