Possible to fully block PublicVault.processEpoch function. No one will be able to receive their funds
Possible to fully block `PublicVault.processEpoch` function. No one will be able to receive their funds\\nWhen liquidity providers want to redeem their share from `PublicVault` they call `redeemFutureEpoch` function which will create new `WithdrawProxy` for the epoch(if not created already) and then mint shares for redeemer in `WithdrawProxy`. `PublicVault` transfer user's shares to himself.\\n```\\n  function redeemFutureEpoch(\\n    uint256 shares,\\n    address receiver,\\n    address owner,\\n    uint64 epoch\\n  ) public virtual returns (uint256 assets) {\\n    // check to ensure that the requested epoch is not the current epoch or in the past\\n    require(epoch >= currentEpoch, "Exit epoch too low");\\n\\n\\n    require(msg.sender == owner, "Only the owner can redeem");\\n    // check for rounding error since we round down in previewRedeem.\\n\\n\\n    ERC20(address(this)).safeTransferFrom(owner, address(this), shares);\\n\\n\\n    // Deploy WithdrawProxy if no WithdrawProxy exists for the specified epoch\\n    _deployWithdrawProxyIfNotDeployed(epoch);\\n\\n\\n    emit Withdraw(msg.sender, receiver, owner, assets, shares);\\n\\n\\n    // WithdrawProxy shares are minted 1:1 with PublicVault shares\\n    WithdrawProxy(withdrawProxies[epoch]).mint(receiver, shares); // was withdrawProxies[withdrawEpoch]\\n  }\\n```\\n\\nThis function mints `WithdrawProxy` shares 1:1 to redeemed `PublicVault` shares. Then later after call of `processEpoch` and `transferWithdrawReserve` the funds will be sent to the `WithdrawProxy` and users can now redeem their shares from it.\\nFunction `processEpoch` decides how many funds should be sent to the `WithdrawProxy`.\\n```\\n    if (withdrawProxies[currentEpoch] != address(0)) {\\n      uint256 proxySupply = WithdrawProxy(withdrawProxies[currentEpoch])\\n        .totalSupply();\\n\\n\\n      liquidationWithdrawRatio = proxySupply.mulDivDown(1e18, totalSupply());\\n\\n\\n      if (liquidationAccountants[currentEpoch] != address(0)) {\\n        LiquidationAccountant(liquidationAccountants[currentEpoch])\\n          .setWithdrawRatio(liquidationWithdrawRatio);\\n      }\\n\\n\\n      uint256 withdrawAssets = convertToAssets(proxySupply);\\n      // compute the withdrawReserve\\n      uint256 withdrawLiquidations = liquidationsExpectedAtBoundary[\\n        currentEpoch\\n      ].mulDivDown(liquidationWithdrawRatio, 1e18);\\n      withdrawReserve = withdrawAssets - withdrawLiquidations;\\n      // burn the tokens of the LPs withdrawing\\n      _burn(address(this), proxySupply);\\n\\n\\n      _decreaseYIntercept(withdrawAssets);\\n    }\\n```\\n\\nThis is how it is decided how much money should be sent to WithdrawProxy. Firstly, we look at totalSupply of WithdrawProxy. `uint256 proxySupply = WithdrawProxy(withdrawProxies[currentEpoch]).totalSupply();`.\\nAnd then we convert them to assets amount. `uint256 withdrawAssets = convertToAssets(proxySupply);`\\nIn the end function burns `proxySupply` amount of shares controlled by PublicVault. `_burn(address(this), proxySupply);`\\nThen this amount is allowed to be sent(if no auctions currently, but this is not important right now).\\nThis all allows to attacker to make `WithdrawProxy.deposit` to mint new shares for him and increase totalSupply of WithdrawProxy, so `proxySupply` becomes more then was sent to `PublicVault`.\\nThis is attack scenario.\\n1.PublicVault is created and funded with 50 ethers. 2.Someone calls `redeemFutureEpoch` function to create new WithdrawProxy for next epoch. 3.Attacker sends 1 wei to WithdrawProxy to make totalAssets be > 0. Attacker deposit to WithdrawProxy 1 wei. Now WithdrawProxy.totalSupply > PublicVault.balanceOf(PublicVault). 4.Someone call `processEpoch` and it reverts on burning.\\nAs result, nothing will be send to WithdrawProxy where shares were minted for users. The just lost money.\\nAlso this attack can be improved to drain users funds to attacker. Attacker should be liquidity provider. And he can initiate next redeem for next epoch, then deposit to new WithdrawProxy enough amount to get new shares. And call `processEpoch` which will send to the vault amount, that was not sent to previous attacked WithdrawProxy, as well. So attacker will take those funds.
Make function WithdrawProxy.deposit not callable.
Funds of PublicVault depositors are stolen.
```\\n  function redeemFutureEpoch(\\n    uint256 shares,\\n    address receiver,\\n    address owner,\\n    uint64 epoch\\n  ) public virtual returns (uint256 assets) {\\n    // check to ensure that the requested epoch is not the current epoch or in the past\\n    require(epoch >= currentEpoch, "Exit epoch too low");\\n\\n\\n    require(msg.sender == owner, "Only the owner can redeem");\\n    // check for rounding error since we round down in previewRedeem.\\n\\n\\n    ERC20(address(this)).safeTransferFrom(owner, address(this), shares);\\n\\n\\n    // Deploy WithdrawProxy if no WithdrawProxy exists for the specified epoch\\n    _deployWithdrawProxyIfNotDeployed(epoch);\\n\\n\\n    emit Withdraw(msg.sender, receiver, owner, assets, shares);\\n\\n\\n    // WithdrawProxy shares are minted 1:1 with PublicVault shares\\n    WithdrawProxy(withdrawProxies[epoch]).mint(receiver, shares); // was withdrawProxies[withdrawEpoch]\\n  }\\n```\\n