Open code423n4 opened 3 years ago
Not sure of reasoning here, never called by another contract - also, any transfer event of the underlying token would be seen.
Reassigning the amount
variable feels like unfinished business. Not sure why it's done, I'll keep this as gas optimization.
Handle
pauliax
Vulnerability details
Impact
function withdrawToAdapter re-assigns the amount but does not use it anywhere later. The declaration of this function could be changed to return this value to indicate the actual withdrawal amount. Also, I think this function should be included in IVault interface as it is externally called.
Recommended Mitigation Steps
Make withdrawToAdapter return the amount that was withdrawn and also include this function in the IVault interface.