Submitted by wait
Malicious users can get more of the RToken appreciation benefit brought by Furnace.sol#melt(), and long-term RToken holders will get less benefit.
RToken holders will be less willing to provide liquidity to RToken pools (such as uniswap pools), resulting in less liquidity of RToken.
A1. Gain revenue from a flashloan sandwich attack
A malicious user can launch a flashloan sandwich attack against Furnace#melt() each time a whole period passed (payout happens).
The attack transaction execution steps:
The implicit assumption here is that most of the time the prices of RToken in RToken.issues(), RToken.redeem(), and DeFi pools are almost equal.
This assumption is reasonable because if there are price differentials, they can be balanced by arbitrage.
The attack can be profitable for:
A2. Get a higher yield by holding RToken for a short period of time
Malicious users can get higher yield by by following these steps:
Since this approach only requires 1 to n blocks to issue in advance, which is typically much smaller than rewardPeriod, the attacker will obtain much higher APR than long-term RToken holders.
Referring to eip-4626, distribute rewards based on time weighted shares.
Alternatively, always use a very small rewardPeriod and rewardRatio, and lower the upper limit MAXRATIO and MAXPERIOD.
0xean (judge) decreased severity to Medium
tbrent (Reserve) commented:
tbrent (Reserve) commented:
Status: Mitigation confirmed with comments. Full details in reports from HollaDieWaldfee, 0xA5DF, and AkshaySrivastav.
