Submitted by cmichel, also found by CertoraInc and Picodes
The ERC4626RouterBase.withdraw function withdraws the asset amount parameter by burning shares.
It then checks that the burned shares sharesOut are not less than a minSharesOut amount.
However, the user wants to be protected against burning too many shares for their specified amount, and therefore a maxSharesBurned amount parameter should be used.
The user can lose their entire shares due to the wrong check.
User calls Router.withdraw(amount=1100, minSharesOut=1000) to protect against not burning more than 1000 shares for their 1100 asset amount.
However, theres an exploit in the vault which makes the sharesOut = 100_000, the entire users shares.
The check then passes as it only reverts if 100_000 < 1000.
Also, rename the variable in TurboRouter.withdraw.
Joeysantoro (Tribe Turbo) disagreed with High severity and commented:
Joeysantoro (Tribe Turbo) resolved and commented:
Alex the Entreprenerd (judge) decreased severity to Medium and commented:
