Submitted by broccoli
An attacker can call the bento.harvest function during the callback function of a flash swap of the HybridPool to reduce the number of input tokens that he has to pay to the pool, as long as there is any unrealized profit in the strategy contract of the underlying asset.
Referenced code:
Consider not using bento.toAmount to track the reservers and balances, but use balanceOf instead (as done in the other two pools).
maxsam4 (Sushi) confirmed:
