VAD37 - mintRollovers() give wrong amount of share/assets to user

[sherlock-admin]

VAD37

high

mintRollovers() give wrong amount of share/assets to user

Summary

The mintRollovers() do the following steps in a loop:

• Take user rollover queue
• withdraw that amount from old epoch. Skip if that withdraw is too small to pay fee or the withdraw rewards amount is lost due to depeg event.
• deposit that amount into latest epoch
• burn previous epoch token share

The deposit/ mint new share for user use wrong variable.
It take the variable set by user queue input while it should take the variable from the withdraw that included premium payout.

Vulnerability Detail

You would expect the mintRollovers() have same logic in withdraw() and then deposit()

The value entitledShares for withdraw is correct same as withdraw() function

File: Earthquake\src\v2\Carousel\Carousel.sol
395:             if (epochResolved[queue[index].epochId]) {
396:                 uint256 entitledShares = previewWithdraw(
397:                     queue[index].epochId,
398:                     queue[index].assets
399:                 );
400:                 // mint only if user won epoch he is rolling over
401:                 if (entitledShares > queue[index].assets) {
402:                     // skip the rollover for the user if the assets cannot cover the relayer fee instead of revert.
403:                     if (queue[index].assets < relayerFee) {
404:                         index++;
405:                         continue;
406:                     }
407:                     // @note we know shares were locked up to this point
408:                     _burn(
409:                         queue[index].receiver,
410:                         queue[index].epochId,
411:                         queue[index].assets
412:                     );
413:                     // transfer emission tokens out of contract otherwise user could not access them as vault shares are burned
414:                     _burnEmissions(
415:                         queue[index].receiver,
416:                         queue[index].epochId,
417:                         queue[index].assets
418:                     );
419:                     // @note emission token is a known token which has no before transfer hooks which makes transfer safer
420:                     emissionsToken.safeTransfer(
421:                         queue[index].receiver,
422:                         previewEmissionsWithdraw(
423:                             queue[index].epochId,
424:                             queue[index].assets
425:                         )
426:                     );
427: 
428:                     emit Withdraw(
429:                         msg.sender,
430:                         queue[index].receiver,
431:                         queue[index].receiver,
432:                         _epochId,
433:                         queue[index].assets,
434:                         entitledShares
435:                     );

Notice the event Withdraw use entitledShares value as WETH received amount.

The next part simplifed from deposit() suddenly use value input by user queue[index].assets instead of withdrawal value entitledShares (aka WETH received amount)

File: Earthquake\src\v2\Carousel\Carousel.sol
436:                     uint256 assetsToMint = queue[index].assets - relayerFee;//@audit H entitledShares not assets
437:                     _mintShares(queue[index].receiver, _epochId, assetsToMint);
438:                     emit Deposit(
439:                         msg.sender,
440:                         queue[index].receiver,
441:                         _epochId,
442:                         assetsToMint
443:                     );

Impact

The user share already burned but does not move entire total share rewards of premium to new epoch.
Locked user funds in old epoch with no way to recover.

Also forgot to take treasury fee during rollover.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L436

Tool used

Manual Review

Recommendation

change queue[index].assets to entitledShares.

Duplicate of #163