Summary
PreDepositVault::sweep() allows sweeping aTokens, decreasing users' deposits. Same for USDS.
Vulnerability Detail
PreDepositVault::totalAssets() is composed of asset() and aToken. Decreasing one of them leads to user losses.
Impact
User losses
Code Snippet
Tool Used
Manual Review
Recommendation
It's an admin function so could be left as is, but keep this in mind.