Submitted by TomFrenchBlockchain, also found by certora
Draining of funds from VaderPoolV2.
See the VaderPool.mintSynth function:
https://github.com/code-423n4/2021-12-vader/blob/fd2787013608438beae361ce1bb6d9ffba466c45/contracts/dex-v2/pool/VaderPoolV2.sol#L153-L194
As the pools reserves can be manipulated through flashloans similar to on UniswapV2 (the slip mechanism can be mitigated by splitting the manipulation over a number of trades), an attacker may set the exchange rate between nativeAsset and synths (calculated from the reserves). An attacker can exploit this to drain funds from the pool.
For the price of a flashloan and some swap fees, the attacker has now managed to extract a large amount of nativeAsset from the pool. This process can be repeated as long as it is profitable.
Tie the exchange rate use for minting/burning synths to a manipulation resistant oracle.
SamSteinGG (Vader) acknowledged
