Submitted by cmichel
The YAxisVotePower.balanceOf contract uses the Uniswap pool reserves to compute a _lpStakingYax reward:
The pool can be temporarily manipulated to increase the _yaxReserves amount.
If this voting power is used for governance proposals, an attacker can increase their voting power and pass a proposal.
One could build a TWAP-style contract that tracks a time-weighted-average reserve amount (instead of the price in traditional TWAPs).
This can then not be manipulated by flashloans.
uN2RVw5q commented:
GalloDaSballo (judge) commented:
