Incorrect Position's Fee Calculation is done on burnOsToken which is not in favor of the protocol

Github username: @evokid Submission hash (on-chain): 0xd5b0fe1a050e72ec33ebdfda4236d9a277a8fe22bb06db1c690c698db4d9c308 Severity: high

Description: Description

Treasury fee is less than it should be in burnOsToken() function, if you look at it you will see that _osToken.burnShares() being called first then _syncPositionFee().

The proof is simple, on _osToken.burnShares() _totalAssets are being decreased which will affect the fee of the position definitely since profitAccrued in cumulativeFeePerShare() is returning the _unclaimedAssets().

Attack Scenario

Jakob calls burnOsToken()

Attachments

Proof of Concept (PoC) On burnOsToken() L99-L104 a burn for osToken's shares is done then _syncPositionFee is called:

    assets = _osToken.burnShares(msg.sender, osTokenShares);

    // fetch user position
    OsTokenPosition memory position = _positions[msg.sender];
    if (position.shares == 0) revert Errors.InvalidPosition();
    _syncPositionFee(position);

If you check burnShares() you will see _totalAssets is being decreased L153:

      _totalAssets -= SafeCast.toUint128(assets);

Now the effect is here because _totalAssets is a factor to calculate cumulativeFeePerShare() which calls _unclaimedAssets() L336

function _unclaimedAssets() internal view returns (uint256) {
    // calculate time passed since the last update
    uint256 timeElapsed;
    unchecked {
      // cannot realistically underflow
      timeElapsed = block.timestamp - _lastUpdateTimestamp;
    }
    if (timeElapsed == 0) return 0;
    return Math.mulDiv(avgRewardPerSecond * _totalAssets, timeElapsed, _wad);
  }
}

We can see from the code above, when _totalAssets decreases, the returned value will be decreased too.

As Result on _syncPositionFee() profitAccrued will be decreased, Therefore treasury assets will decreased.

Recommendations: _syncPositionFee() should be called before _osToken.burnShares().

hats-finance / StakeWise-0xd91cd6ed6c9a112fdc112b1a3c66e47697f522cd

Incorrect Position's Fee Calculation is done on burnOsToken which is not in favor of the protocol #94