Summary

Vault locked credit capacity is wrongly checked when user redeems.

Vulnerability Details

A vault's lockedCreditRatio determines how much of the vault's total assets can't be withdrawn according to the Vault's total debt, it is expected that after user redeems, the withdrawn amount should be less than the total amount - locked amount.

However, in redeem(), protocol wrongly checks the locked credit capacity against withdrawn amount instead of the left credit capacity (total amount - locked amount).

VaultRouterBranch::redeem():

Impact

The locked credit capacity is used to secure the credit delegation system, this issue let user withdraw more collateral than allowed, leading to potential liquidity issues to connected markets.

Tools Used

Manual Review

Recommendations

Check locked credit capacity againt the left credit capacity in the vault.