unsafe cast can lead to theft

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-concur/blob/main/contracts/ConvexStakingWrapper.sol#L261
https://github.com/code-423n4/2022-02-concur/blob/main/contracts/ConvexStakingWrapper.sol#L235

Vulnerability details

in the first link I provided, a hacker can call withdraw with amount = 2**196, the amount of shares that will be burned is uint192(2**192) == 0.
if the system has enough money, the hacker can steal 2**192 tokens and pay nothing.

for the second link, a user that provides more than 2**192 tokens, the amount of shares they will be truncated and they will get less than they should.

Recommended Mitigation Steps

use safe cast of openzeppelin.

[GalloDaSballo]

While the warden intuition is correct, the lack of POC makes the finding fall under scrutiny.
The casting on the ConvexStakingWrapper is to uint192 however the masterchef contract which will be notified of the withdrawal uses uint128 meaning that the shown POC will revert and won't allow for any value extraction.

If a common denominator between the two where to be found such that _amount was zero in both contracts, then value extraction could happen.

However this POC is not developed enough to sustain this reasoning.

Because of that I'm going to mark this as duplicate of #194 as the casting problem is more developed there