hickuphh3 - Users lose profit in mintRollovers from incorrect variable used

[sherlock-admin]

hickuphh3

high

Users lose profit in mintRollovers from incorrect variable used

Summary

If users win an epoch, they are credited entitledShares which is greater than queueItem.assets, but assetsToMint uses the latter instead, resulting in the difference being unaccounted for / lost.

Vulnerability Detail

Minting rollovers only happen if the user won an epoch, where entitledShares is expected to be greater than queueItem.assets.

uint256 entitledShares = previewWithdraw(
  queueItem.epochId,
  queueItem.assets
);
// mint only if user won epoch he is rolling over
if (entitledShares > queueItem.assets) {

However, the assetsToMint is calculated as

uint256 assetsToMint = queueItem.assets - relayerFee;

where queueItem.assets is used instead of entitledShares. The difference entitledShares - queueItem.assets is therefore unaccounted for.

Impact

Users' profits are lost.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L396-L401
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L436-L437

Tool used

Manual Review

Recommendation

- uint256 assetsToMint = queueItem.assets - relayerFee;
+ uint256 assetsToMint = entitledShares - relayerFee;

Technically, the same change can be applied for the minimum relayer fee check too:

- if (queueItem.assets < relayerFee) {
+ if (entitledShares < relayerFee) {

Duplicate of #163