blackhole - Incorrect value calculation in _getValueOfSplitFinalizedWithdrawRequest due to missing decimals conversion

[sherlock-admin2]

blackhole

High

Incorrect value calculation in _getValueOfSplitFinalizedWithdrawRequest due to missing decimals conversion

Summary

If a withdraw request is split and finalized, _getValueOfSplitFinalizedWithdrawRequest will be invoked to calculate the value of the split request.
However, the function does not account for the decimals of the borrowToken, which can result in an incorrect value calculation when borrowToken is not redeemToken.

Vulnerability Detail

s.totalWithdraw represents the amount of redeemToken, so when the borrowToken is not equal to redeemToken, the decimals conversion is neccessary for calculating the correct value.

    return (s.totalWithdraw * rate.toUint() * w.vaultShares) / 
                (s.totalVaultShares * Constants.EXCHANGE_RATE_PRECISION);

Impact

The incorrect value calculation can lead to an incorrect calculation of collateralRatio in notional VaultAcccountHealth, result in a loss of funds for the user.

Code Snippet

https://github.com/sherlock-audit/2024-06-leveraged-vaults/blob/main/leveraged-vaults-private/contracts/vaults/common/WithdrawRequestBase.sol#L80

    function _getValueOfSplitFinalizedWithdrawRequest(
        WithdrawRequest memory w,
        SplitWithdrawRequest memory s,
        address borrowToken,
        address redeemToken
    ) internal virtual view returns (uint256) {
        // If the borrow token and the withdraw token match, then there is no need to apply
        // an exchange rate at this point.
        if (borrowToken == redeemToken) {
            return (s.totalWithdraw * w.vaultShares) / s.totalVaultShares;
        } else {
            // Otherwise, apply the proper exchange rate
            (int256 rate, /* */) = Deployments.TRADING_MODULE.getOraclePrice(redeemToken, borrowToken);

            return (s.totalWithdraw * rate.toUint() * w.vaultShares) / 
                (s.totalVaultShares * Constants.EXCHANGE_RATE_PRECISION); // @audit -high missing redeemDecimals to borrowDecimals conversion
        }
    }

Tool used

Manual Review

Recommendation

It's recommended to add the borrowToken decimals conversion to the _getValueOfSplitFinalizedWithdrawRequest function to calculate the correct value when borrowToken is not equal to redeemToken.

Duplicate of #60