Submitted by WatchPug
For UniV3Vault, it seems that lp fees are collected through collectEarnings() callable by the strategy and reinvested (rebalanced).
However, in the current implementation, unharvested yields are not included in tvl(), making it vulnerable to front-run attacks that steal pending yields.
Given:
As a result, the attacker has stolen half of the pending yields in about 1 block of time.
Consider including fees in tvl().
For the code to calculate fees earned, please reference _computeFeesEarned() in G-UNI project:
MihanixA (Mellow Protocol) confirmed:
