Submitted by cmichel, also found by 0xsanson and 0xRajeev
The Vault.withdraw function attempts to withdraw funds from the controller if there are not enough in the vault already.
In the case the controller could not withdraw enough, i.e., where _diff < _toWithdraw, the user will receive less output tokens than their fair share would entitle them to (the initial _amount).
The withdrawer receives fewer output tokens than they were entitled to.
In the mentioned case, the _shares should be recomputed to match the actual withdrawn _amount tokens:
Only these shares should then be burned.
uN2RVw5q commented:
GalloDaSballo (judge) commented:
BobbyYaxis (yAxis) noted:
