Submitted by 0xpiken, also found by 0xlemon, pfapostol, and shaflow2
https://github.com/code-423n4/2024-12-bakerfi/blob/main/contracts/core/MultiStrategy.sol#L265
A leverage strategy with deployed assets can not be removed from MultiStrategyVault due to insufficient assets
MultiStrategyVault is used to manage multiple investment strategies. The vault manager can remove an existing strategy by calling MultiStrategy#removeStrategy():
If the strategy to be removed has deployed assets, it will be undeployed first and then allocated to other strategies. It is expected that the equivalent amount of assets will be received when calling IStrategy.undeploy():
However, the amount of received assets could be less than strategyAssets if the strategy is a leverage strategy.
When a leverage strategy is used to undeploy assets:
Note: please see scenario in wardens original submission.
When removing a strategy from MultiStrategyVault, ensure the amount of assets to be re-allocated is same as the received amount:
chefkenji (BakerFi) confirmed
BakerFi mitigated:
Status: Mitigation confirmed. Full details in reports from 0xlemon and shaflow2.
