Submitted by GalloDaSballo
The function _deposit sets mapMemberSynth_lastTime to a date in the future in synthVault.sol L107.
mapMemberSynth_lastTime is also used to calculate rewards earned. depositForMember allows anyone, to make a donation for the member and cause that member to lose all their accrued rewards. This cant be used for personal gain, but can be used to bring misery to others.
depositForMember (in synthVault.sol on L95 can be called by anyone.
This will set the member and can be continuously exploited to make members never earn any reward.
This is the second submission under the same exploit.
This can be mitigated by harvesting for the user right before changing mapMemberSynth_lastTime[_member][_synth]
verifyfirst (Spartan) commented:
