Submitted by zaskoh, also found by UdarTeam, ak1, and 0xTraub
https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/apps/smart-contracts/core/contracts/PrePOMarket.sol#L68
https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/apps/smart-contracts/core/contracts/PrePOMarket.sol#L109
The documentation states that minting of the Short and Long tokens should only be done by the governance.
The problem is, that as long as the _mintHook is not set via setMintHook, everyone can use the mint function and mint short and long tokens.
At the moment the _mintHook is not set in the contructor of PrePOMarket and so the transaction that will set the _mintHook can be front run to mint short and long tokens for the attacker.
https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/apps/smart-contracts/core/contracts/PrePOMarket.sol#L68
https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/apps/smart-contracts/core/contracts/PrePOMarket.sol#L109
This test shows how an attacker could frontrun the setMintHook function:
To prevent the front-running, the \_mintHook should be set in the deployment in the PrePOMarketFactory.
You could add one more address to the createMarket that accepts the mintHook address for that deployment and just add the address after the PrePOMarket ist deployed in the Factory.
Alternatively you could add a default MintHook-Contract address that will always revert until its changed to a valid one.
ramenforbreakfast (prePO) acknowledged 
