When withdrawing funds from the strategy, the PoolStrategy assumes that the exact amount of want tokens is withdrawn and increases the stake balance by amount. However, this may not always be true, depending on the strategy or the yield source of the strategy. The actual return number of tokens could be less than the provided parameter amount, thus resulting in an inaccurate stake balance. (For example, some vaults return only their total balance when the desired withdrawal amount exceeds it.)
Consider modifying the withdraw function of IStrategy to return a uint indicating the actual withdraw amount from the yield source. Take AaveV2 as an example, directly return the result from Aave (line 95), which is the actual withdraw amount according to Aave's documentation.
Handle
shw
Vulnerability details
Impact
When withdrawing funds from the
strategy
, thePoolStrategy
assumes that the exactamount
ofwant
tokens is withdrawn and increases the stake balance byamount
. However, this may not always be true, depending on the strategy or the yield source of the strategy. The actual return number of tokens could be less than the provided parameteramount
, thus resulting in an inaccurate stake balance. (For example, some vaults return only their total balance when the desired withdrawal amount exceeds it.)Proof of Concept
Referenced code: PoolStrategy.sol#L79-L80
Recommended Mitigation Steps
Consider modifying the
withdraw
function ofIStrategy
to return auint
indicating the actual withdraw amount from the yield source. TakeAaveV2
as an example, directly return the result from Aave (line 95), which is the actual withdraw amount according to Aave's documentation.