Slow Sky Puma - User gets fewer Numa tokens when burning nuAsset tokens

[sherlock-admin3]

Slow Sky Puma

Medium

User gets fewer Numa tokens when burning nuAsset tokens

Summary

Incorrect calculation in NumaPrinter.sol results in user getting fewer Numa tokens when burning nuAsset tokens to mint Numa tokens

Root Cause

In NumaPrinter.sol, a wrong calculation is done to get the highest amount between the amount of Numa generated from the Vault buy price and the amount of Numa generated LP Price, and this results a lower amount of Numa returned to burnAssetInputToNuma.

Internal pre-conditions

1. User needs to call burnAssetInputToNuma when vault buy price != LP Price

External pre-conditions

No response

Attack Path

1. User calls burnAssetInputToNuma when vault buy price != LP Price
2. getNbOfNumaFromAssetWithFeeis called to fetch the max amount of Numa minted from burning _nuAssetAmount
3. Higher amount of Numa between vault buy price amountnumaAmountVault and LP price amount numaAmountPrice is returned

Impact

The user receives less Numa tokens than should be sent, when burning nuAssetAmount of nuAsset tokens.

PoC

No response

Mitigation

The line

if (numaAmountVault < numaAmountPool) costWithoutFee = numaAmountVault;

should be changed to

if (numaAmountVault > numaAmountPool) costWithoutFee = numaAmountVault;