Submitted by walker, also found by cmichel and shw
The sherlock smart contract system uses internal bookkeeping of arbitrary ERC20 token balances. It doesnt assert that the ERC20 doesnt implement some non-standard behavior. For example, deflationary tokens, or tokens with a transfer fee, will result in incorrect internal balances. In summary, an attacker can perform stake and deposit actions without actually depositing the amount that sherlock assumes. As a result, an attacker is unduly rewarded balance and yield.
An example location where such internal bookkeeping happens can be found here
Mitigating the issue is possible by requiring the amount to be added to the contracts balance. Alternatively, its possible to update the pool based on actual balance changes.
Evert0x (Sherlock) acknowledged and disagreed with severity:
ghoul-sol (judge) commented:
