# `ManagedLeveragedVault::deposit()` slippage control on `collVaultShares` is not intuitive Low/Info · Sherlock · CDP stablecoin · 25th April, 2025 Finding L-2 of the Beraborrow Managed Dens security review. - Protocol: https://www.beraborrow.com/ - Report: /reports/beraborrow-i - Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85 --- ## Summary `ManagedLeveragedVault::deposit()` has slippage control for `collVaultShares` but it applies to the full deposited collateral when the user only gets a share of it due to entry fees. ## Vulnerability Detail The deposit function is: ```solidity function deposit(uint256 assets, address receiver, AddCollParams calldata params) public notPaused nonReentrant returns (uint256 shares) { BoycoVaultStorage storage b$ = _getBoycoVaultStorage(); shares = _deposit(assets, receiver); IERC20(asset()).forceApprove(address(b$.collVault), assets); uint256 collVaultShares = b$.collVault.deposit(assets, address(this)); if (collVaultShares < params.minSharesOut) revert VaultSlippage(params.minSharesOut, collVaultShares); _addColl(collVaultShares, params.upperHint, params.lowerHint); } ``` The user deposits assets and pays entry fees. However, the `params.minSharesOut` parameter is compared against `collVaultShares`, which comes from converting the whole assets deposited into collateral vault shares. This can be unexpected for users as slippage control on a deposit function should be on the amount the user actually gets (assets minus entry fees), but it currently compares against all assets deposited. ## Impact UX issues. Some users may be caught off guard but it only leads to reverts at max. ## Code Snippet https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR278 ## Tool Used Manual Review ## Recommendation Apply slippage control to the net `collVaultShares` the user mints. --- Related findings: - [The basic strategy does not have slippage control when withdrawing which may lead to arbitrage](https://0xsimao.com/findings/maple-finance-iv-slippage-control-withdrawing-arbitrage): Maple Cash Strategies - [MidnightSupplyVaultSharesCallback deposits into ERC4626 without a min shares slippage bound](https://0xsimao.com/findings/tenor-markets-callback-erc4626-slippage-bound): Tenor Morpho Migrations - [`LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-slippage): Teller Finance - [`VaultV2::withdraw/redeem()` are vulnerable to slippage, so another function could be added to protect users](https://0xsimao.com/findings/morpho-vault-v2-withdraw-redeem-slippage-protect): Morpho Vault V2