Submitted by pauliax, also found by eriksal1217
function withdraw in ILendingPool returns the actual withdrawn amount, however, function withdraw in AaveV2 strategy does not check this return value so e.g. function strategyWithdraw may actually withdraw less but still add the full amount to the staked balance:
Recommend that function withdraw in IStrategy should return uint indicating the actual withdrawn amount and functions that use it should account for that.
Evert0x (Sherlock) confirmed:
