Submitted by jonah1005, also found by adelamo_
Synth realise function calculates baseValueLP and baseValueSynth base on AMM spot price which is vulnerable to flash loan attack. Synths lp is subject to realise whenever the AMM ratio is different than Synths debt ratio.
The attack does not necessarily require a flash loan. A big whale of the lp token holders could keep calling realise by shifting token ratio of AMM pool back and forth.
The vulnerability is located at Synth.sol L187-L199. Where the formula here is dangerous.
Heres a script for conducting flashloan attack:
Output:
Calculating Lp tokens value base on AMM protocol is known to be dangerous.
There are a few steps that might solve the issue:
verifyfirst (Spartan) confirmed and disagreed with severity:
