Interest component of underlying amount is not withdrawable using the `withdrawLend` function. Such amount is permanently locked in the BlueBerryBank contract
Soft vault shares are issued against interest bearing tokens issued by `Compound` protocol in exchange for underlying deposits. However, `withdrawLend` function caps the withdrawable amount to initial underlying deposited by user (pos.underlyingAmount). Capping underlying amount to initial underlying deposited would mean that a user can burn all his vault shares in `withdrawLend` function and only receive original underlying deposited.\\nInterest accrued component received from Soft vault (that rightfully belongs to the user) is no longer retrievable because the underlying vault shares are already burnt. Loss to the users is permanent as such interest amount sits permanently locked in Blueberry bank.\\n`withdrawLend` function in `BlueBerryBank` allows users to withdraw underlying amount from `Hard` or `Soft` vaults. `Soft` vault shares are backed by interest bearing `cTokens` issued by Compound Protocol\\nUser can request underlying by specifying `shareAmount`. When user tries to send the maximum `shareAmount` to withdraw all the lent amount, notice that the amount withdrawable is limited to the `pos.underlyingAmount` (original deposit made by the user).\\nWhile this is the case, notice also that the full `shareAmount` is deducted from `underlyingVaultShare`. User cannot recover remaining funds because in the next call, user doesn't have any vault shares against his address. Interest accrued component on the underlying that was returned by `SoftVault` to `BlueberryBank` never makes it back to the original lender.\\n```\\n    wAmount = wAmount > pos.underlyingAmount\\n            ? pos.underlyingAmount\\n            : wAmount;\\n\\n        pos.underlyingVaultShare -= shareAmount;\\n        pos.underlyingAmount -= wAmount;\\n        bank.totalLend -= wAmount;\\n```\\n
Introduced a new variable to adjust positions & removed cap on withdraw amount.\\nHighlighted changes I recommend to withdrawLend with //******//.\\n```\\nfunction withdrawLend(address token, uint256 shareAmount)\\n        external\\n        override\\n        inExec\\n        poke(token)\\n    {\\n        Position storage pos = positions[POSITION_ID];\\n        Bank storage bank = banks[token];\\n        if (token != pos.underlyingToken) revert INVALID_UTOKEN(token);\\n        \\n        //*********-audit cap shareAmount to maximum value, pos.underlyingVaultShare*******\\n        if (shareAmount > pos.underlyingVaultShare) {\\n            shareAmount = pos.underlyingVaultShare;\\n        }\\n\\n        // if (shareAmount == type(uint256).max) {\\n        //     shareAmount = pos.underlyingVaultShare;\\n        // }        \\n\\n        uint256 wAmount;\\n        uint256 amountToOffset; //*********- audit added this to adjust position********\\n        if (address(ISoftVault(bank.softVault).uToken()) == token) {\\n            ISoftVault(bank.softVault).approve(\\n                bank.softVault,\\n                type(uint256).max\\n            );\\n            wAmount = ISoftVault(bank.softVault).withdraw(shareAmount);\\n        } else {\\n            wAmount = IHardVault(bank.hardVault).withdraw(token, shareAmount);\\n        }\\n\\n        //*********- audit calculate amountToOffset********\\n        //*********-audit not capping wAmount anymore*******\\n        amountToOffset = wAmount > pos.underlyingAmount\\n            ? pos.underlyingAmount\\n            : wAmount;\\n\\n        pos.underlyingVaultShare -= shareAmount;\\n     //*********-audit subtract amountToOffset instead of wAmount*******\\n        pos.underlyingAmount -= amountToOffset;\\n        bank.totalLend -= amountToOffset;\\n\\n        wAmount = doCutWithdrawFee(token, wAmount);\\n\\n        IERC20Upgradeable(token).safeTransfer(msg.sender, wAmount);\\n    }\\n```\\n
Every time, user withdraws underlying from a Soft vault, interest component gets trapped in BlueBerry contract. Here is a scenario.\\nAlice deposits 1000 USDC into `SoftVault` using the `lend` function of BlueberryBank at T=0\\nUSDC soft vault mints 1000 shares to Blueberry bank\\nUSDC soft vault deposits 1000 USDC into Compound & receives 1000 cUSDC\\nAlice at T=60 days requests withdrawal against 1000 Soft vault shares\\nSoft Vault burns 1000 soft vault shares and requests withdrawal from Compound against 1000 cTokens\\nSoft vault receives 1050 USDC (50 USDC interest) and sends this to BlueberryBank\\nBlueberry Bank caps the withdrawal amount to 1000 (original deposit)\\nBlueberry Bank deducts 0.5% withdrawal fees and deposits 995 USDC back to user\\nIn the whole process, Alice has lost access to 50 USDC.
```\\n    wAmount = wAmount > pos.underlyingAmount\\n            ? pos.underlyingAmount\\n            : wAmount;\\n\\n        pos.underlyingVaultShare -= shareAmount;\\n        pos.underlyingAmount -= wAmount;\\n        bank.totalLend -= wAmount;\\n```\\n