Submitted by zzzitron, also found by unforgiven
MED - a hypothetical attack path with stated assumptions, but external requirements.
Attacker can create a vault with successful buyout status and non zero supply. The attacker can sell the fractions and then simply withdraw the assets.
Now, the attacker can send in some assets to the vault and sell the fractions. Then, the attacker can withdraw any asset at any time from the vault using the buyout module, because the state is already SUCCESS.
Note: An attacker can achieve the similar result with plugins. However, users might just refuse to buy tokens associated with such vaults and plugins. With the current issue, the user who is only looking at the vault will not notice this possibility unless they also check the status in the buyout module for the vault.
Foundry
Update totalSupply before _mint.
stevennevins (Fractional) disagreed with severity
HardlyDifficult (judge) commented:
