Imbalance and LP gain is forever stuck in USDMPegRecovery

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-concur/blob/72b5216bfeaa7c52983060ebfc56e72e0aa8e3b0/contracts/USDMPegRecovery.sol

Vulnerability details

Impact

After depositing into Curve, underlying USDM and pool3 of each LP share will change due to

1. Swap fee
2. Pool imbalance

However, userLiquidity does not update according to current underlying LP balance. When guardian remove liquidity from Curve, at least 1 of the token would have an increased balance. These balance cannot be claimed by anyone because sum of userLiquidity represent the old balance. If any of the token have a decreased balance (e.g. caused by pool imbalance), withdrawal would be served in first-come-first-served basis. Any gained tokens are stuck in the contract.

Proof of Concept

https://github.com/code-423n4/2022-02-concur/blob/72b5216bfeaa7c52983060ebfc56e72e0aa8e3b0/contracts/USDMPegRecovery.sol

1. Alice deposit 100 USDM to the contract
2. Bob deposit 100 pool3 to the contract
3. Guardian add 100 USDM and 100 pool3 liquidity to Curve
4. Due to trading and pool imbalance, the LP shares are now worth 1000 USDM and 10 pool3
5. Guardian remove liquidity
6. The contract have 1000 USDM and 10 pool3
7. Alice withdraw 100 USDM successfully
8. Bob can only withdraw 10 pool3
9. The contract have 900 USDM stuck

Recommended Mitigation Steps

A share type accounting would be prefered, but can be complex considering there are 2 tokens.

[GalloDaSballo]

Duplicate of #70