VaultV2::withdraw/redeem() are vulnerable to slippage, so another function could be added to protect users
Summary
As per the ERC4626 spec, VaultV2::withdraw/redeem() don't receive a slippage parameter, which makes them vulnerable to slippage. This is relevant as the underlying vaults can register losses, and could surprise users redeeming who get these losses. Having a function or router that includes slippage protection could be useful for users to protect them.
Vulnerability Detail
The underlying adapters can register losses, which would be socialized among users of the VaultV2. In case one of them decides to withdraw or redeem and be frontrunned by one of these losses, they would receive a surprisingly lower amount of assets, incurring losses.
Impact
User loss on withdrawal.
Code Snippet
Tool Used
Manual Review
Recommendation
Add a function or router that includes slippage protection.