Insurance.getVaultDeltaForDeposit returns wrong investDelta

[code423n4]

Handle

cmichel

Vulnerability details

Vulnerability Details

On single deposits, the getVaultDeltaForDeposit function is supposed to return 100% allocation for the desired vault to invest in.
However, it always sets 100% allocation to the first vault (index 0) because of using the wrong variable:

uint256[N_COINS] memory vaultIndexes;
// ...
// uses uninitialized vaultIndexes!
// same as investDelta[0] = 10000;
investDelta[vaultIndexes[0]] = 10000;

Impact

The investDelta also indicates that one would invest 100% in the first vault even if vaultIndexes suggests a different priority.

Recommended Mitigation Steps

Use _vaultIndexes (return value of sortVaultsByDelta) instead of the uninitialized vaultIndexes.

[kitty-the-kat]

investDelta isnt used, variable has been removed to not cause confusion

[flabble-gro]

Duplicate of #65

[ghoul-sol]

Indeed, investDelta is returned but not used. Duplicate of #65 so low risk.