Anyone can send the USDC interest to the balancer pool by calling withdrawFundsOnBehalf(balancerPool).
An attacker can abuse this to capture part of this interest by doing the following steps in a single transaction:
USDC interest that was supposed to go to MPT balancer pool stakers is stolen by attackers.
Funds might be locked forever.
This is hard to prevent completely because youre sending free money to the pool.
One way to reduce the risk is to only allow claiming interest by the governor / trusted parties. This would disallow attacker to perform this in a risk-free way in a single transaction, but the same attack would still be possible for miners.
Consider alternative ways of distributing the interest of balancer pools like transferring it to all MPT holders instead of liquidity providers, because:
lucas-manuel (Maple) disputed:
Nick Johnson (Judge):
