eeyore - In Vault.calculateStack() function the ratiosX96Value value is rounded down

[sherlock-admin2]

eeyore

Medium

In Vault.calculateStack() function the ratiosX96Value value is rounded down

Summary

The ratiosX96Value calculations are rounded in a way that is unfavorable to the protocol.

Vulnerability Detail

The ratiosX96Value is used as a denominator for calculations of user withdrawal amounts and, as such, should always be rounded in a way that is favorable to the protocol, in this case, up.

Impact

Withdrawal values will be rounded in favor of the user.

Code Snippet

https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/Vault.sol#L530
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/Vault.sol#L487
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/Vault.sol#L495

Tool used

Manual Review

Recommendation

When calculating ratiosX96Value, use rounding up:

        for (uint256 i = 0; i < tokens.length; i++) {
            uint256 priceX96 = priceOracle.priceX96(address(this), tokens[i]);
            s.totalValue += FullMath.mulDiv(amounts[i], priceX96, Q96);
-           s.ratiosX96Value += FullMath.mulDiv(s.ratiosX96[i], priceX96, Q96);
+           s.ratiosX96Value += FullMath.mulDivRoundingUp(s.ratiosX96[i], priceX96, Q96);
            s.erc20Balances[i] = IERC20(tokens[i]).balanceOf(address(this));
        }

Duplicate of #61