Liquidity Management

Summary

_handleReturn() double-counts withdrawn, allowing to get excess funds.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/main/contracts/PerpetualVault.sol#L1129

Consider this scenario:

• Vault total assets = 1,000 USDC

• totalShares = 1,000 shares

• User holds 100 shares (10%)

1. The user calls withdraw(), triggering a partial close of GMX MarketSwap.

2. After the GMX MarketSwap, the Vault receives 50 USDC.

   • withdrawn = 50

   • _handleReturn() is called with withdrawn = 50.

3. withdrawn = 50 USDC
   
   Vault balance = 1,000 USDC
   
   BeforeWithdrawal = 1,000 - 50 = 950 USDC\

   shares = 100 (10%)
   
   amount = 50 + 95 = 145 USDC
   
   The user ultimately receives 145 USDC, which is 45 USDC more than the 100 USDC they should have received!

I