_update() in Vault.update() does not return updated context, hence _saveContext() only saves the previous loaded context in memory and not the updated context
Vulnerability Detail
In the Vault contract, the external function update(), is meant to update the account's position anddepositing depositAssets assets, redeeming redeemShares shares, and claiming claimAssets assets by calling the internal function _update() with the local context variable as part of the arguments supplied. However the _update() function does not return the updated context thus making the call to _saveContext() only save the previous loaded context in memory and not the updated context. This means that the account's position updates are not saved.
cryptphi
high
Vault.update() does not save updated context
Summary
_update() in Vault.update() does not return updated context, hence
_saveContext()
only saves the previous loaded context in memory and not the updated contextVulnerability Detail
In the Vault contract, the external function update(), is meant to update the account's position anddepositing
depositAssets
assets, redeemingredeemShares
shares, and claimingclaimAssets
assets by calling the internal function_update()
with the local context variable as part of the arguments supplied. However the _update() function does not return the updated context thus making the call to_saveContext()
only save the previous loaded context in memory and not the updated context. This means that the account's position updates are not saved.Impact
Loss of funds
Code Snippet
https://github.com/sherlock-audit/2023-07-perennial/blob/main/perennial-v2/packages/perennial-vault/contracts/Vault.sol#L215C1-L217C17
_loadContext(account)
sets context values to a local Context variableTool used
Manual Review
Recommendation
Vault._update()
function should returnContext memory context
values for _saveContext to store the new context values.