Submitted by cmichel, also found by WatchPug
Aave uses rebasing tokens which means the token balance aToken.balanceOf(this) increases over time with the accrued interest.
The AaveVault.tvl uses a cached value that needs to be updated using a updateTvls call.
This call is not done when depositing tokens which allows an attacker to deposit tokens, get a fair share of the old tvl, update the tvl to include the interest, and then withdraw the LP tokens receiving a larger share of the new tvl, receiving back their initial deposit + the share of the interest.
This can be done risk-free in a single transaction.
The interest since the last TVL storage update can be stolen as Aave uses rebasing tokens but the tvl is not first recomputed when depositing.
If the vaults experience low activity a significant amount of interest can accrue which can all be captured by taking a flashloan and depositing and withdrawing a large amount to capture a large share of this interest
Update the tvl when depositing and withdrawing before doing anything else.
MihanixA (Mellow Protocol) confirmed
