Submitted by broccoli, also found by WatchPug
It is possible to overflow the addition in the balance check (i.e., _balance(tokenIn) >= amountIn + reserve) in the mint function by setting the amountIn to a large amount. As a result, the attacker could gain a large number of LP tokens by not even providing any liquidity. The attackers liquidity would be much greater than any other LPs, causing him could effectively steal others funds by burning his liquidity (since the funds he receives are proportional to his liquidity).
Referenced code:
Consider removing the uncheck statement to prevent integer overflows from happening.
maxsam4 (Sushi) acknowledged:
