_depositAmount requires to be updated to contract balance increase

[code423n4]

Lines of code

https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/inception/AdminInceptionVault.sol#L75-L89

Vulnerability details

Impact

Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered.
It is required to find out contract balance increase/decrease after the transfer.

Proof of Concept

Tools Used

Recommended Mitigation Steps

Recommended code:
function depositAndBorrow(
address _collateralType,
uint256 _depositAmount,
uint256 _borrowAmount
) external override onlyOwner {
IERC20 asset = IERC20(_collateralType);

uint256 balanceBefore = asset.balanceOf(address(this)); // remembering asset balance before the transfer
asset.safeTransferFrom(msg.sender, address(this), _depositAmount);
_depositAmount = asset.balanceOf(address(this)) - balanceBefore; // updating actual _depositAmount to the contract balance increase

asset.safeIncreaseAllowance(address(_a.core()), _depositAmount);
_a.core().depositAndBorrow(_collateralType, _depositAmount, _borrowAmount);
if (_collateralId[_collateralType] == 0) {
    uint8 newId = ++_collateralCount;
    _collateralId[_collateralType] = newId;
    _collaterals[newId] = _collateralType;
}

}

[m19]

Duplicate of #156

[gzeoneth]

Consider with warden's' QA report #51