TrungOre - Users can lose their profit when using a rollover mechanism

[sherlock-admin]

TrungOre

high

Users can lose their profit when using a rollover mechanism

Summary

Instead of minting a number of shares corresponding to previewWithdraw() return value, function Carousel.mintRollovers() just mints the origionalqueue[index].assets shares for the user when minting for rollover of a new epoch.

Vulnerability Detail

After an epoch is resolved, the users who deposited into the vault can get the profit/loss based on whether the de-peg events occur during the epoch time.
Assume that a user who deposited 100 ETH into the Risk vault gets 10 ETH profit (he has 110 ETH in total) because there was no de-peg event is trigger during the epoch time. Instead of withdrawing the fund, he calls Carousel.minRollover() to reinvest all of his money for the upcoming epochs.

function mintRollovers(uint256 _epochId, uint256 _operations)
    external
    epochIdExists(_epochId)
    epochHasNotStarted(_epochId)
    nonReentrant
{
    /// ... 
    
    while ((index - prevIndex) < (_operations)) {
        /// ... 
        uint256 assetsToMint = queue[index].assets - relayerFee;
        _mintShares(queue[index].receiver, _epochId, assetsToMint);
        /// ... 
    }
}

However, the amount of shares that the user will be minted for the next epoch is just queue[index].assets - relayerFee which is just 100 ETH - relayerFee instead of 110 ETH - relayerFee.
--> 10 ETH profit from the previous epoch is lost
--> The user loses funds.

Impact

Users lose their profit from previous epochs.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L436-L437

Tool used

Manual Review

Recommendation

Calculate the assetsToMint as follows:

/// url = https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L436-L437
uint256 assetsToMint = entitledShares - relayerFee;
_mintShares(queue[index].receiver, _epochId, assetsToMint);

Duplicate of #163