Submitted by gzeon, also found by Inspecktor, Breeje, 0xMirce, and ptsanev
Vaults are created from the factory via CREATE1. An attacker can front-run deployVault to deploy at the same address, but with different config. If the deployed chain reorg, a different vault might also be deployed at the same address.
https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/VaultFactory.sol#L67-L78
Use CREATE2 and the vault config as salt.
MEV
asselstine (PoolTogether) disputed and commented:
Picodes (judge) commented:
PoolTogether mitigated:
Status: Mitigation confirmed. Full details in reports from dirk_y, rvierdiiev and 0xStalin.
