Submitted by GalloDaSballo, also found by carrotsmuggler, kaden, and cergyk
The BalancerStrategy uses a cached value to determine its balance in pool for which it takes Single Sided Exposure.
This means that the Strategy has some BPT tokens, but to price them, its calling vault.queryExit which simulates withdrawing the LP in a single sided manner.
Due to the single sided exposure, its trivial to perform a Swap, that will change the internal balances of the pool, as a way to cause the Strategy to discount its tokens.
By the same process, we can send more ETH as a way to inflate the value of the Strategy, which will then be cached.
Since _currentBalance is a view-function, the YieldBox will accept these inflated values without a way to dispute them
https://github.com/Tapioca-DAO/tapioca-yieldbox-strategies-audit/blob/05ba7108a83c66dada98bc5bc75cf18004f2a49b/contracts/balancer/BalancerStrategy.sol#L138-L147
Imbalance Up -> Allows OverBorrowing and causes insolvency to the protocol
Imbalance Down -> Liquidate Borrowers unfairly at a profit to the liquidator
Sandwhiching the Imbalance can be used to extract value from the strategy and steal user deposits as well
Use fair reserve math, avoid single sided exposure (use the LP token as underlying, not one side of it)
cryptotechmaker (Tapioca) confirmed
