Performance and management fee updates may technically still apply to already earned interest
Summary
Due to the max rate mechanism, interest earned will be capped by the max rate. Thus, even if the past interest is accrued as per the rate before changing the fees, the actual interest earned that will be attributed to the Vault over time will use the new rate, but it corresponds to deposits made with the old rate.
Vulnerability Detail
VaultV2::setPerformanceFee() correctly accrues interest first, and only changes the fee afterwards, link. However, note that the interest accrued is capped by the max rate, link. This means that the pending interest earned while the old rate was active will be now applied the new rate.
Impact
Under/over charging fees.
Code Snippet
Tool Used
Manual Review
Recommendation
There are ways to fix this but not quite trivial.