In _depositOnVaultCreation, totalAssets is incremented by shares rather than assets

[hats-bug-reporter]

Github username: --
Twitter username: --
Submission hash (on-chain): 0xc4f119a4045fa21a13f7f2a8d6f1c9796d5a179a87c0df0b70828b2b7460ecd1
Severity: high

Description:
Description
Upon creation of an Atom, a user can be the first depositor in the Atom they've created using _depositOnVaultCreation.

Let's take a deeper look in _depositOnVaultCreation:

For easier explanation, let's assume 5 assets = 1 share;

_setVaultTotals is executed inside _depositOnVaultCreation to increase the totalAssets and totalShares after the deposit.
The problem here is both totalAssets and totalShares are increased with the totalDelta amount which holds the user's shares.

        uint256 totalDelta = isAtomWallet ? sharesForReceiver : sharesForReceiver + sharesForZeroAddress;

        // set vault totals for the vault
        _setVaultTotals(id, vaults[id].totalAssets + totalDelta, vaults[id].totalShares + totalDelta);

Attack Scenario
If a user deposits 5 ETH, the totalAssets should be increased with 5 and totalShares with only 1.

However, the totalAssetswill be increased with only 1 making the user at a loss.

Attachments

1. Proof of Concept (PoC) File

2. Revised Code File (Optional)

-        // set vault totals for the vault _setVaultTotals(id, vaults[id].totalAssets + totalDelta, vaults[id].totalShares + totalDelta);

+        // set vault totals for the vault _setVaultTotals(id, vaults[id].totalAssets + assets, vaults[id].totalShares + totalDelta);

[mihailo-maksa]

The report states that in the _depositOnVaultCreation function, totalAssets is incorrectly incremented by shares rather than assets.

Label: invalid

Comment:
When creating a vault, the assets-to-shares ratio is always 1:1. Therefore, incrementing totalAssets by totalShares or vice versa achieves the same result, making the current implementation valid.

Comment on the issue:
When creating a vault, the assets-to-shares ratio is always 1:1. Thus, incrementing totalAssets by totalShares or vice versa achieves the same result, making the current implementation valid. For clarity, we will add a comment in the code.