Submitted by WatchPug
https://github.com/code-423n4/2021-11-vader/blob/429970427b4dc65e37808d7116b9de27e395ce0c/contracts/dex-v2/pool/VaderPoolV2.sol#L284-L335
https://github.com/code-423n4/2021-11-vader/blob/429970427b4dc65e37808d7116b9de27e395ce0c/contracts/dex-v2/pool/VaderPoolV2.sol#L126-L167
Funds are transferred from the from parameter, and the output tokens are transferred to the to parameter, both passed by the caller without proper access control.
This issue allows anyone to call mintFungible() and mintSynth() and steal almost all their wallet balances for all the users who have approved the contract before.
SamSteinGG (Vader) commented:
alcueca (judge) commented:
SamSteinGG (Vader) commented:
