Submitted by ni8mare, also found by ni8mare, hals, and shaka
It is theoretically possible for the deposit amount to mint shares more than the maxMint amount
The deposit function has a check for maxDeposit and reverts if the deposit value is more than max(uint96). But, it does not check the shares to be less than maxMint amount and hence, bypasses the check. Theoretically, if the assets are equal to max(uint96) and if the vault is under-collateralized, the ratio of _assetUnit to _exchangeRate is greater than or equal to 2, then the calculation in _convertToShares.
Function _assets.mulDiv(_assetUnit, _exchangeRate, _rounding); could return a value more than the maxMint amount. This is possible in scenarios where the _assetUnit is a big enough number (as there is no limit on the decimals of the underlying asset, and _assetUnit = 10 ** super.decimals()) and the Vault is severely under-collateralized.
Include the maxMint check in the deposit function to prevent this problem.
Invalid Validation
asselstine (PoolTogether) confirmed
PoolTogether mitigated:
Status: Mitigation confirmed. Full details in reports from 0xStalin, dirk_y and rvierdiiev.
