Vulnerability: anyone can withdraw storage fees from contracts based on `contractMain.fc`

[tochilinak]

The reserved amount of TONs is calculated by the following formula:

;; Storage fees are deducted from the contract balance
int baseline = (getContractBalance() - storage_fees()) - (getMsgValue() - getDonationNanos());

The issue is that storage phase is executed before compute phase (docs).
So storage fees are already deducted from getContractBalance. This way you reserve storage_fees less than you should.
And when you then send a message with send mode 128 (all remaining balance), storage_fees are actually transfered to the message sender.

Reproducing transaction.

Found automatically by https://tonsec.dev/.