LiquidityPool.sol doesn't respect fully EIP 4626

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L383-L393
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L396-L406

Vulnerability details

Impact

The EIP-4626 states that the function previewMint and previewWithdraw should be rounded up always, but that is not the case in the InvestmentManager.sol which makes it not fully compliant.

Proof of Concept

As can be seen by EIP-4626
https://eips.ethereum.org/EIPS/eip-4626
the function previewDeposit and previewRedeem must round down, which is done trough the whole functions, but previewMint and previewWithdraw should be rounded up, which is not the case as can be seen here https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L579-L581.
This will make the LiquidityPool.sol not fully EIP-4626 compliant as stated, which can lead to wrong assumptions if other protocol interact with Centrifuge.

Tools Used

Manual review

Recommended Mitigation Steps

Consider implementing EIP-4626 fully and correctly to prevent wrong assumptions.

Assessed type

ERC4626

[c4-pre-sort]

raymondfam marked the issue as low quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #25

[c4-judge]

gzeon-c4 marked the issue as unsatisfactory:
Invalid

[c4-judge]

gzeon-c4 removed the grade

[c4-judge]

gzeon-c4 marked the issue as not a duplicate

[c4-judge]

gzeon-c4 marked the issue as duplicate of #34

[c4-judge]

gzeon-c4 marked the issue as satisfactory