Submitted by 0x52, also found by ayeslick
User funds stolen.
Swap data is completely arbitrary and can be used to swap though malicious ERC20 tokens allowing control transfer. This control transfer would allow the attacker to call rebalance on a second vault and exploit both as long as both vaults rebalance into the same vault.
Assumptions:
Vault A and C both rebalance into vault B (i.e. value is transferred from vault A and C to vault B)
Vault A and C are both eligible for rebalances
Vault A -
Value: $100
Flashloan value: 50
Vault B -
Value: $100
Vault C -
Value: $100
Flashloan value: 50
The attacker has now stolen funds, up to half the value of the total rebalance amount.
Add nonReentrant modifier to MIMOAutomatedRebalnce.sol#rebalance.
RayXpub (Mimo) disagreed with severity and commented:
gzeoneth (judge) decreased severity to Medium 
horsefacts (warden) reviewed mitigation:
