YieldNest – Vault not compliant with ERC4626 in maxWithdraw function

This results in non-compliance with the ERC4626 standard, leading to the potential
for withdrawal attempts based on maxWithdraw results to fail.

Vulnerability Details

Per the ERC4626 standard, the maxWithdraw function is required to return the maximum amount of assets that can be withdrawn without causing a revert, and this amount must not exceed the actual maximum that can be accepted.

In the BaseVault and KernelStrategy contracts, the maxWithdraw function has not been updated to include fees. As a result, it calculates the total assets without factoring in the fees, which may cause the calculated shares to exceed the user’s available shares when they attempt to withdraw the maximum amount suggested by maxWithdraw .

Vulnerable scenario

The following actions illustrate this issue:

1. An external application integrates with MaxVault, adding a feature for users to withdraw their total assets.
2. A user initiates a request to withdraw all their assets.
3. The external application calls maxWithdraw to determine the total withdrawable assets for that user, then invokes the withdraw function.
4. The MaxVault computes the shares to be burnt using the previewWithdraw function, which results in a calculation that suggests burning more shares than the user possesses.
5. The transaction reverts during the _burn function call.