The _deposit function increases the members weight by _weight = iUTILS(UTILS()).calcValueInBase(iSYNTH(_synth).TOKEN(), _amount); which is the swap output amount when trading the deposited underlying synth amount.
Notice that anyone can create synths of custom tokens by calling Pools.deploySynth(customToken).
Therefore an attacker can deposit valueless custom tokens and inflate their member weight as follows:
Call harvest(realSynth) with a synth with actual value. This will increase the synth balance and it can be withdrawn later.
Anyone can inflate their member weight through depositing a custom synth and earn almost all vault rewards by calling harvest(realSynth) with a valuable real synth.
The rewards are distributed pro rata to the member weight which is independent of the actual synth deposited.
The calcReward function completely disregards the synth parameter which seems odd.
Recommend thinking about making the rewards based on the actual synths deposited instead of a global weight tracker.
Alternatively, whitelist certain synths that count toward the weight, or dont let anyone create synths.
strictly-scarce (vader) confirmed:
