Submitted by cmichel
The SynthVault.harvestSingle function can be used to mint & deposit synths without using a lockup. An attacker sends BASE tokens to the pool and then calls harvestSingle. The inner iPOOL(_poolOUT).mintSynth(synth, address(this)); call will mint synth tokens to the vault based on the total BASE balance sent to the pool, including the attackers previous transfer.
They are then credited the entire amount to their weight.
This essentially acts as a (mint +) deposit without a lock-up period.
Recommend syncing the pool before sending BASE to it through iRESERVE(_DAO().RESERVE()).grantFunds(reward, _poolOUT); such that any previous BASE transfer is wasted. This way only the actual rewards weight is increased.
verifyfirst (Spartan) disputed:
SamusElderg (Spartan) confirmed:
