Submitted by cmichel
The protocol computes a factor when minting (and burning) tokens, which is the exchange rate of rebase to base tokens (base supply / total assets value), see GToken.factor().
The first user can manipulate this factor such that it always returns 0.
Example:
The resulting factor is 0 and thus any user-deposits by depositGToken will mint 0 base tokens to the depositor.
This means all deposits and future value accrues to the attacker who holds the only base tokens.
An attacker could even front-run the first minter to steal their deposit this way.
Uniswap solves a similar problem by sending the first 1000 tokens to the zero address which makes the attack 1000x more expensive. The same should work here, i.e., on first mint (total base supply == 0), lock some of the first minters tokens by minting ~1% of the initial amount to the zero address instead of to the first minter.
kristian-gro (Gro) acknowledged but disagreed with severity:
ghoul-sol (Judge) commented:
