Submitted by cccz
RewardThrottle.populateFromPreviousThrottle allows ADMIN_ROLE to use epochData from previousThrottle to populate state from activeEpoch to epoch in current RewardThrottle.
But since populateFromPreviousThrottle and \_fillInEpochGaps have basically the same function, a malicious user can call fillInEpochGaps to front-run populateFromPreviousThrottle.
The only difference is that it seems that populateFromPreviousThrottle can make epoch and activeEpoch greater than timekeeper.epoch(), thereby updating the state for future epochs, but \_fillInEpochGaps makes activeEpoch = timekeeper.epoch(), thereby invalidating populateFromPreviousThrottle for future updates. (This usage should be very unlikely).
https://github.com/code-423n4/2023-02-malt/blob/700f9b468f9cf8c9c5cffaa1eba1b8dea40503f9/contracts/RewardSystem/RewardThrottle.sol#L660-L688
If populateFromPreviousThrottle is used to initialize the state in the current RewardThrottle, it should be called on contract setup.
0xScotch (Malt) confirmed and commented:
