Submitted by unforgiven
https://github.com/reserve-protocol/protocol/blob/df7ecadc2bae74244ace5e8b39e94bc992903158/contracts/p1/StRSR.sol#L160-L188
https://github.com/reserve-protocol/protocol/blob/df7ecadc2bae74244ace5e8b39e94bc992903158/contracts/p1/StRSR.sol#L496-L530
https://github.com/reserve-protocol/protocol/blob/df7ecadc2bae74244ace5e8b39e94bc992903158/contracts/p1/StRSR.sol#L212-L237
Code calculates amount of stake token and rsr token based on stakeRate and if stakeRate was near 1e18 then division error is small but attacker can cause stakeRate to be 1 and that can cause users to loss up to 1e18 token during stake and unstake.
This is init() code:
As you can see it sets the value of the rsrRewardsAtLastPayout as contract balance when contract is deployed.
This is _payoutReward() code:
As you can see it sets the value of the stakeRate  to (totalStakes * FIX_ONE_256 + (stakeRSR - 1)) / stakeRSR.
So to exploit this attacker needs to perform these steps:
so attacker can manipulate the stakeRate in contract deployment time with sandwich attack which can cause other users to lose funds because of the big rounding error.
VIM
Prevent early manipulation of the PPS.
tbrent (Reserve) confirmed
tbrent (Reserve) commented:
Status: Mitigation confirmed with comments. Full details in reports from 0xA5DF, HollaDieWaldfee, and AkshaySrivastav.
