Vulnerability: The maximum size of an `ICHI` vault spell position can be arbitrarily surpassed
Severity: medium

Description:
The maximum size of an `ICHI` vault spell position can be arbitrarily surpassed by subsequent deposits to a position due to a flaw in the `curPosSize` calculation.\\nIchi vault spell positions are subject to a maximum size limit to prevent large positions, ensuring a wide margin for liquidators and bad debt prevention for the protocol.\\nThe maximum position size is enforced in the `IchiVaultSpell.depositInternal` function and compared to the current position size `curPosSize`.\\nHowever, the `curPosSize` does not reflect the actual position size, but the amount of Ichi vault LP tokens that are currently held in the `IchiVaultSpell` contract (see L153).\\nAssets can be repeatedly deposited into an Ichi vault spell position using the `IchiVaultSpell.openPosition` function (via the `BlueBerryBank.execute` function).\\nOn the very first deposit, the `curPosSize` correctly reflects the position size. However, on subsequent deposits, the previously received Ichi `vault` LP tokens are kept in the `BlueBerryBank` contract. Thus, checking the balance of `vault` tokens in the `IchiVaultSpell` contract only accounts for the current deposit.\\nTest case\\nTo demonstrate this issue, please use the following test case:\\n```\\ndiff --git a/test/spell/ichivault.spell.test.ts b/test/spell/ichivault.spell.test.ts\\nindex 258d653..551a6eb 100644\\n--- a/test/spell/ichivault.spell.test.ts\\n// Add the line below\\n// Add the line below\\n// Add the line below\\n b/test/spell/ichivault.spell.test.ts\\n@@ -163,6 // Add the line below\\n163,26 @@ describe('ICHI Angel Vaults Spell', () => {\\n                                afterTreasuryBalance.sub(beforeTreasuryBalance)\\n                        ).to.be.equal(depositAmount.mul(50).div(10000))\\n                })\\n// Add the line below\\n               it("should revert when exceeds max pos size due to increasing position", async () => {\\n// Add the line below\\n                       await ichi.approve(bank.address, ethers.constants.MaxUint256);\\n// Add the line below\\n                       await bank.execute(\\n// Add the line below\\n                               0,\\n// Add the line below\\n                               spell.address,\\n// Add the line below\\n                               iface.encodeFunctionData("openPosition", [\\n// Add the line below\\n                                       0, ICHI, USDC, depositAmount.mul(4), borrowAmount.mul(6) // Borrow 1.800e6 USDC\\n// Add the line below\\n                               ])\\n// Add the line below\\n                       );\\n// Add the line below\\n\\n// Add the line below\\n                       await expect(\\n// Add the line below\\n                               bank.execute(\\n// Add the line below\\n                                       0,\\n// Add the line below\\n                                       spell.address,\\n// Add the line below\\n                                       iface.encodeFunctionData("openPosition", [\\n// Add the line below\\n                                               0, ICHI, USDC, depositAmount.mul(1), borrowAmount.mul(2) // Borrow 300e6 USDC\\n// Add the line below\\n                                       ])\\n// Add the line below\\n                               )\\n// Add the line below\\n                       ).to.be.revertedWith("EXCEED_MAX_POS_SIZE"); // 1_800e6 // Add the line below\\n 300e6 = 2_100e6 > 2_000e6 strategy max position size limit\\n// Add the line below\\n               })\\n                it("should be able to return position risk ratio", async () => {\\n                        let risk = await bank.getPositionRisk(1);\\n                        console.log('Prev Position Risk', utils.formatUnits(risk, 2), '%');\\n```\\n\\nRun the test with the following command:\\n```\\nyarn hardhat test --grep "should revert when exceeds max pos size due to increasing position"\\n```\\n\\nThe test case fails and therefore shows that the maximum position size can be exceeded without reverting.

Impact:
The maximum position size limit can be exceeded, leading to potential issues with liquidations and bad debt accumulation.

Recommended mitigation:
Consider determining the current position size using the `bank.getPositionValue()` function instead of using the current Ichi vault LP token balance.