Overexert on-chain slippage/loss control may cause users' funds to be frozen in the contract

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/GeneralVault.sol#L125

Vulnerability details

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/GeneralVault.sol#L125

require(withdrawAmount >= _amount.percentMul(99_00), Errors.VT_WITHDRAW_AMOUNT_MISMATCH);

The GeneralVault.sol contract comes with a on-chain slippage/loss control to ensure the output amount is no more than 1% less of the requested amount.

This can be a problem when the wrapped asset in underlying protocol is now trading at a discount or loss.

For example, if Lido's setETH is trading at a more than 1% of discount on Curve (which is the case at the moment of writing), trying to withdraw as ETH will always fail with error: VT_WITHDRAW_AMOUNT_MISMATCH.

Since GeneralVault is the super class for all kinds of vaults, when the underlying protocol is suffering a loss of > 1% or the wrapped token is trading at a discount > 1% for a long period of time, this can be major problem that pervents all users from withdrawing.

In essence, causing the funds to be frozen in the contract.

Recommendation

Consider adding a minAmountOut as slippage control and allow the user to decide the minimum acceptable amount in outToken.

[sforman2000]

Duplicate of #133 (high risk)