SRC-6 example contract does not update managed assets (#122)

* Update SRC-6 example with decrementation of managed assets

* Update CHANGELOG

* Fix link on CHANGELOG.md

* Update CHANGELOG to resolve markdown error with duplicate headers

* Write to storage

CHANGELOG.md

@@ -11,8 +11,7 @@ Description of the upcoming release here.
 
 ### Added Unreleased
 
-- Something new here 1
-- Something new here 2
+- Something new here
 
 ### Changed Unreleased
 
@@ -22,8 +21,9 @@ Description of the upcoming release here.
 ### Fixed Unreleased
 
 - [#121](https://github.com/FuelLabs/sway-standards/pull/121) Fixes the `deposit` function in the SRC-6 standard, uses try_read instead of read in order to allow first time deposits to a vault.
+- [#122](https://github.com/FuelLabs/sway-standards/pull/122) Fixes the SRC-6 example contract from a critical bug where the contract can be drained.
 
-#### Breaking Unreleased
+### Breaking Unreleased
 
 - Some breaking change here 1
 - Some breaking change here 2

examples/src6-vault/multi_asset_vault/src/main.sw

@@ -88,6 +88,10 @@ impl SRC6 for Contract {
         require(msg_asset_id() == share_asset_id, "INVALID_ASSET_ID");
         let assets = preview_withdraw(share_asset_id, shares);
 
+        let mut vault_info = storage.vault_info.get(share_asset_id).read();
+        vault_info.managed_assets = vault_info.managed_assets - shares;
+        storage.vault_info.insert(share_asset_id, vault_info);
+
         _burn(share_asset_id, share_asset_vault_sub_id, shares);
 
         transfer(receiver, underlying_asset, assets);

examples/src6-vault/single_asset_single_sub_vault/src/main.sw

@@ -78,6 +78,10 @@ impl SRC6 for Contract {
         require(msg_asset_id() == share_asset_id, "INVALID_ASSET_ID");
         let assets = preview_withdraw(shares);
 
+        storage
+            .managed_assets
+            .write(storage.managed_assets.read() - shares);
+
         _burn(share_asset_id, shares);
 
         transfer(receiver, underlying_asset, assets);

examples/src6-vault/single_asset_vault/src/main.sw

@@ -89,6 +89,10 @@ impl SRC6 for Contract {
         require(msg_asset_id() == share_asset_id, "INVALID_ASSET_ID");
         let assets = preview_withdraw(share_asset_id, shares);
 
+        let mut vault_info = storage.vault_info.get(share_asset_id).read();
+        vault_info.managed_assets = vault_info.managed_assets - shares;
+        storage.vault_info.insert(share_asset_id, vault_info);
+
         _burn(share_asset_id, share_asset_vault_sub_id, shares);
 
         transfer(receiver, underlying_asset, assets);