Submitted by jonah1005
Pool is created in function createPoolADD. The price (rate) of the token is determined in this function. Since the address is deterministic, the attacker can front-run the createPoolADD transaction and sends tokens to Pools address. This would make the pool start with an extreme price and create a huge arbitrage space.
I assume pools would be created by the deployer rather than DAO at the early stage of the protocol.
If the deployer calls createPoolADD and addCuratedPool at the same time then an attacker/arbitrager could actually get (huge) profit by doing this.
Assume that the deployer wants to create a BNB pool at an initial rate of 10000:300 and then make it a curated pool.
An arbitrager can send 2700 BNB to the (precomputed) pool address and make iBNB 10x cheaper. The arbitrager can mint the synth at a 10x cheaper price before the price becomes normal.
poolFactory.sol L45-L62
Recommend adding:
In createPoolADD
verifyfirst (Spartan) acknowledged:
