BalancedVault.claim can be called in not favorable situation

Summary

BalancedVault.claim can be called in not favorable situation to make claimer receive less.

Vulnerability Detail

BalancedVault.claim can be called by anyone. You need to provide account, which will be claimed. https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L210-L228

     */
    function claim(address account) external {
        (EpochContext memory context, ) = _settle(account);

        UFixed18 unclaimedAmount = _unclaimed[account];
        UFixed18 unclaimedTotal = _totalUnclaimed;
        _unclaimed[account] = UFixed18Lib.ZERO;
        _totalUnclaimed = unclaimedTotal.sub(unclaimedAmount);
        emit Claim(msg.sender, account, unclaimedAmount);

        // pro-rate if vault has less collateral than unclaimed
        UFixed18 claimAmount = unclaimedAmount;
        UFixed18 totalCollateral = _assets();
        if (totalCollateral.lt(unclaimedTotal)) claimAmount = claimAmount.muldiv(totalCollateral, unclaimedTotal);

        _rebalance(context, claimAmount);

        asset.push(account, claimAmount);
    }

In case, when asset balance is less than unclaimedTotal, then users will receive less amount. if (totalCollateral.lt(unclaimedTotal)) claimAmount = claimAmount.muldiv(totalCollateral, unclaimedTotal);

totalCollateral is not stale value as it's changing with every position closing and settlement. As such it's possible that sometimes totalCollateral can become less than unclaimedTotal and then in some time become bigger again.

Malicious user can wait for such events in order to claim less amount to the claimers, who didn't claim yet. As result of this he can increase amount per share for the users who still in the vault and make losses for users, that are now claimed by him.

Impact

User;s account can be claimed not in the best time and make losses.

Code Snippet

Provided above

Tool used

Manual Review

Recommendation

Do not allow someone else to claim user's account.

Duplicate of #174

sherlock-audit / 2023-05-perennial-judging

rvierdiiev - BalancedVault.claim can be called in not favorable situation #212