Submitted by cmichel
The LPIssuer.deposit first computes balanced amounts on the users defined tokenAmounts.
The idea is that LP tokens give the same percentage share of each vault tokens tvl, therefore the provided amounts should be balanced, meaning, the depositAmount / tvl ratio should be equal for all vault tokens.
But the strategist can frontrun the users deposit and rebalance the vault tokens, changing the tvl for each vault token which changes the rebalance.
This frontrun can happen accidentally whenever the strategist rebalances
Theres a vault with two tokens A and B, tvls are [500, 1500]
Users can get rekt when depositing as the received LP amount is unpredictable and lead to a trade using a very different balanced token mix that they never intended.
Add minimum return amount checks.
Accept a function parameter that can be chosen by the user indicating their expected LP amount for their deposit tokenAmounts, then check that the actually minted LP token amount is above this parameter.
MihanixA (Mellow Protocol) confirmed
