NOTE: Users should only withdraw "free" assets as some strategies need to divest "gracefully", and a large withdrawal could incur a loss, which will get passed back to the withdrawer.
This basically means that once the user deposit the fund into the vault, the vault may need to invest the fund into stragety and it takes for stragty to generate yield.
For example, a lending stragety may have lending term mature period, redeem before mature period can incur loss.
As the doc said: and a large withdrawal could incur a loss, which will get passed back to the withdrawer. This could be the high early withdrawal fee charged by underlying stragety or large trade slippage when exiting the position.
without implementation cooldown period for withdraw and deposit, the heedless withdraw by user can result in loss of fund.
Tools Used
Manual Review
Recommended Mitigation Steps
Implement the cooldown period for yearn adapter deposit / withdraw operation to avoid the loss.
Lines of code
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/adapter/yearn/YearnAdapter.sol#L17
Vulnerability details
Impact
lack of cooldown period for Yearn adapter operation.
Proof of Concept
In the current implemntation, in YearnAdapter, the user can deposit or withdraw with the yearn vault. however, according to the Yearn documentation,
https://github.com/yearn/yearn-devdocs/blob/master/docs/developers/v2/SPECIFICATION.md#normal-operation
This basically means that once the user deposit the fund into the vault, the vault may need to invest the fund into stragety and it takes for stragty to generate yield.
For example, a lending stragety may have lending term mature period, redeem before mature period can incur loss.
As the doc said: and a large withdrawal could incur a loss, which will get passed back to the withdrawer. This could be the high early withdrawal fee charged by underlying stragety or large trade slippage when exiting the position.
without implementation cooldown period for withdraw and deposit, the heedless withdraw by user can result in loss of fund.
Tools Used
Manual Review
Recommended Mitigation Steps
Implement the cooldown period for yearn adapter deposit / withdraw operation to avoid the loss.