Calculate the balance difference consistently

[gpersoon]

Vulnerability details

The function function convert of GeneralConverter.sol calculates the number of tokens to be transferred by subtracting the balance after with the balance before.

                   uint256 _before = xxx.balanceOf(address(this));
                   // action
                   uint256 _after = xxx.balanceOf(address(this));
                    _outputAmount = _after.sub(_before);
                    xxx.safeTransfer(msg.sender, _outputAmount);

However this only happens in the first 2 pieces of the code (e.g. swapping to or from tokenCRV).
When swapping between 2 of the underlying tokens this pattern isn't used.

Proof of concept

metavault/contracts/v3/converters/GeneralConverter.sol

Lines 154 to 155 in 014fd27

	_outputAmount = IERC20(_output).balanceOf(address(this));
	IERC20(_output).safeTransfer(msg.sender, _outputAmount);

Recommended mitigation steps

Use the pattern to calculate the balance difference also when swapping between 2 of the underlying tokens.