The Treasury (which benefits Governance) collects a "management fee" based on the total assets the Vault has over a period of time, assessed each time the Strategy interacts with the Vault, and is provided as newly minted shares to the Treasury.
The Treasury (which benefits Governance) collects a "performance fee" based on the amount of returns a Strategy produces during Normal Operation, assessed each time the Strategy interacts with the Vault, and is provided as newly minted shares to the Treasury.
ach Strategist collects a "performance fee" based on the amount of positive returns their Strategy produces during Normal Operation, assessed each time the Strategy interacts with the Vault, and is provided as newly minted shares to the Strategist.
Performane fee, management fee are charged on Yearn vault side, but if we look into the implementation of YearnAdapter.sol,
contract YearnAdapter is AdapterBase {
which inherits from the regular ERC4646 inmplementation:
abstract contract AdapterBase is
ERC4626Upgradeable,
the previewMint, previewRedeem, previewDeposit, previewWithdraw, does not consider the performance fee and maange fee charged.
This result that the preview related function over-estimate the available share can be minted nad available asset that can be withdraw / redeemed.
The result is quite miss leading and user can unexpected loss fund on the fee with interact with YearnAdapter.sol
Tools Used
Manual Review
Recommended Mitigation Steps
We recommend the protocol estimate the management fee and performance fee in the preview related functoin in YearnAdapter.sol
Lines of code
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/adapter/abstracts/AdapterBase.sol#L28 https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/adapter/yearn/YearnAdapter.sol#L17
Vulnerability details
Impact
YearnAdapter previewRedeem / previewWithdraw does not consider the fee on yearn vault side.
Proof of Concept
According to the Yearn vault smart contract,
https://github.com/yearn/yearn-devdocs/blob/master/docs/developers/v2/SPECIFICATION.md#fees
the yearn vault charges fees:
Performane fee, management fee are charged on Yearn vault side, but if we look into the implementation of YearnAdapter.sol,
which inherits from the regular ERC4646 inmplementation:
the previewMint, previewRedeem, previewDeposit, previewWithdraw, does not consider the performance fee and maange fee charged.
This result that the preview related function over-estimate the available share can be minted nad available asset that can be withdraw / redeemed.
The result is quite miss leading and user can unexpected loss fund on the fee with interact with YearnAdapter.sol
Tools Used
Manual Review
Recommended Mitigation Steps
We recommend the protocol estimate the management fee and performance fee in the preview related functoin in YearnAdapter.sol