Submitted by fs0c, also found by 0xmuxyz, bin2chen, ladboy233, Kumpa, nadin, DadeKuma, koxuan, rvierdiiev, and rvi0x
Malicious users can drain the assets of the vault.
The withdraw function users convertToShares to convert the assets to the amount of shares. These shares are burned from the users account and the assets are returned to the user.
The function withdraw is shown below:
The function convertToShares is shown below:
It uses Math.Rounding.Down , but it should use Math.Rounding.Up
Assume that the vault with the following state:
Assume that Alice wants to withdraw 99 WETH from the vault. Thus, she calls theVault.withdraw(99 WETH)function.
The calculation would go like this:
The value would be rounded round to zero. This will be the amount of shares burned from users account, which is zero.
Hence user can drain the assets from the vault without burning their shares.
Use Math.Rounding.Up instead of Math.Rounding.Down.
As per OZ implementation here is the rounding method that should be used:
deposit : convertToShares  Math.Rounding.Down
mint : converttoAssets  Math.Rounding.Up
withdraw : convertToShares  Math.Rounding.Up
redeem : convertToAssets   Math.Rounding.Down
RedVeil (Popcorn) confirmed, but disagreed with severity 
LSDan (judge) decreased severity to Medium 
