Submitted by 0x3b, also found by jaraxxus and twicek
Deposit and mint under LiquidityPool lack access control, which enables any user to proceed the  mint/deposit for another user. Attacker can deposit (this does not require tokens) some wai before users TX to DoS the deposit.
deposit and mint do processDeposit/processMint which are the secondary functions to the requests. These function do not take any value in the form of tokens, but only send shares to the receivers. This means they can be called for free.
With this an attacker who wants to DoS a user, can wait him to make the request to deposit and on the next epoch front run him by calling  deposit with something small like 1 wei. Afterwards when the user calls deposit, his TX will inevitable revert, as he will not have enough balance for the full deposit.
Have some access control modifiers like withApproval used also in redeem.
Access Control
hieronx (Centrifuge) confirmed and commented:
