Submitted by 0xNazgul
https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/actions/automated/MIMOAutoAction.sol#L32
https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/actions/automated/MIMOAutoRebalance.sol#L54
A vaultOwner who is not confident enough in ourselves to stay up-to-date with market conditions to know when we should move to less volatile collateral to avoid liquidations. They can open their vault to other users who pay attention to the markets and would call rebalance to receive the incentivized fees. The vaultOwner who doesnt want to pay the baiting high fees instead front-runs the autoRebalance() with setAutomation() to lower incentives.
Add a time-lock to setAutomation so that the vaultOwner cant front-run users.
RnkSngh (Mimo) confirmed and commented:
horsefacts (warden) reviewed mitigation:
