Submitted by cmichel
MultiRateLimited.sol#L280
When the bufferCap is updated for an address in _updateAddress, the addresss allowed buffer (bufferStored) is replenished to the entire bufferCap.
The address could frontrun the updateAddress call and spend their entire buffer, then the buffer is replenished and they can spend their entire buffer a second time.
Keep the old buffer value, capped by the new bufferCap:
ElliotFriedman (Volt) confirmed and commented:
