Submitted by cmichel, also found by 0xliumin, CertoraInc, Picodes, and Ruhum
The ERC4626.mint function mints amount instead of shares.
This will lead to issues when the asset <> shares are not 1-to-1 as will be the case for most vaults over time.
Usually, the asset amount is larger than the share amount as vaults receive asset yield.
Therefore, when minting, shares should be less than amount.
Users receive a larger share amount here which can be exploited to drain the vault assets.
Assume vault.totalSupply() = 1000, totalAssets = 1500
In deposit:
Alex the Entreprenerd (judge):
