ETH deposited by the user may be stolen.
In the `deposit` function, if the user pays with ETH, it will first call `_processEthIn` to wrap it and then call `pullToken` to transfer.\\n```\\n    /// @inheritdoc ILMPVaultRouterBase\\n    function deposit(\\n        ILMPVault vault,\\n        address to,\\n        uint256 amount,\\n        uint256 minSharesOut\\n    ) public payable virtual override returns (uint256 sharesOut) {\\n        // handle possible eth\\n        _processEthIn(vault);\\n\\n        IERC20 vaultAsset = IERC20(vault.asset());\\n        pullToken(vaultAsset, amount, address(this));\\n\\n        return _deposit(vault, to, amount, minSharesOut);\\n    }\\n```\\n\\n`_processEthIn` will wrap ETH into WETH, and these WETH belong to the contract itself.\\n```\\n    function _processEthIn(ILMPVault vault) internal {\\n        // if any eth sent, wrap it first\\n        if (msg.value > 0) {\\n            // if asset is not weth, revert\\n            if (address(vault.asset()) != address(weth9)) {\\n                revert InvalidAsset();\\n            }\\n\\n            // wrap eth\\n            weth9.deposit{ value: msg.value }();\\n        }\\n    }\\n```\\n\\nHowever, `pullToken` transfers from `msg.sender` and does not use the WETH obtained in `_processEthIn`.\\n```\\n    function pullToken(IERC20 token, uint256 amount, address recipient) public payable {\\n        token.safeTransferFrom(msg.sender, recipient, amount);\\n    }\\n```\\n\\nIf the user deposits 10 ETH and approves 10 WETH to the contract, when the deposit amount is 10, all of the user's 20 WETH will be transferred into the contract.\\nHowever, due to the `amount` being 10, only 10 WETH will be deposited into the vault, and the remaining 10 WETH can be stolen by the attacker using `sweepToken`.\\n```\\n    function sweepToken(IERC20 token, uint256 amountMinimum, address recipient) public payable {\\n        uint256 balanceToken = token.balanceOf(address(this));\\n        if (balanceToken < amountMinimum) revert InsufficientToken();\\n\\n        if (balanceToken > 0) {\\n            token.safeTransfer(recipient, balanceToken);\\n        }\\n    }\\n```\\n\\nBoth `mint` and `deposit` in `LMPVaultRouterBase` have this problem.
Perform operations based on the size of `msg.value` and amount:\\nmsg.value == amount: transfer WETH from contract not `msg.sender`\\nmsg.value > amount: transfer WETH from contract not `msg.sender` and refund to `msg.sender`\\nmsg.value < amount: transfer WETH from contract and transfer remaining from `msg.sender`
ETH deposited by the user may be stolen.
```\\n    /// @inheritdoc ILMPVaultRouterBase\\n    function deposit(\\n        ILMPVault vault,\\n        address to,\\n        uint256 amount,\\n        uint256 minSharesOut\\n    ) public payable virtual override returns (uint256 sharesOut) {\\n        // handle possible eth\\n        _processEthIn(vault);\\n\\n        IERC20 vaultAsset = IERC20(vault.asset());\\n        pullToken(vaultAsset, amount, address(this));\\n\\n        return _deposit(vault, to, amount, minSharesOut);\\n    }\\n```\\n