Submitted by etherhood
In absorb, since shrine.melt is being called after free, caller will end up receiving less compensation than actually intended. It is because in free, while checking user deposits, there are two cases when user has pending redistribution with exception:
1: Users yang 1 has zero balance
2: Users yang 1 has non zero balance
In both cases users balances are due for an update, if first n yang balances are zero, caller will miss out on compensation from unaccounted yang updates from all yangs due for redistribution until it encounters one with non zero yang balance. When it encounters first non-zero yang balance, it will still miss out on unaccounted fund from that yang as well, but after that it will be okay, since charge() would be called inside seize function which will then update balances for all yangs.
This is inside free function, where only after first non-zero yang balance is seize called and redistribution updated for trove and all its yangs. All calls to deposit will return less than actual balance of trove.
VS Code
The absorb function should update order of melt and free:
tserg (Opus) commented:
tserg (Opus) confirmed, but disagreed with severity and commented:
0xsomeone (judge) decreased severity to Medium and commented:
