[OZ: C-03] The vault can be drained one share at a time

[Robsonsjre]

During the withdrawal process, users can specify the amount of assets to withdraw, which is
then rounded down to shares.

When the asset amount specified by the user is less than the minimum amount that can be
converted to a unit share, the shares argument is zero in the internal withdraw function but
the assets argument is not. Hence, with zero shares, all internal calls can succeed and a
non-zero amount of asset token will be transferred out to the receiver without burning any
shares.

This process can be repeated many times to drain the entire vault. The attack can also
be executed with any asset amount by burning a rounded-down amount of shares and
extracting the excess assets.

Since the vault is expected to become more valuable over time due to its yield strategy, this
could lead to a profitable attack when one share is worth more than the cost.

Recommendation: Consider rounding up the shares for a given amount of assets during withdrawal.