Submitted by bin2chen
The current mechanism of validateOffer() is to first book _outstandingValues to increase, but assets.balanceOf(address(this)) doesnt decrease immediately.
I.e.: After this method is called, _getUndeployedAssets() is unchanged, but _getTotalOutstandingValue() is increased, so totalAssets() is increased, but totalSupply is unchanged, so exchangeRate is get bigger.
Originally, it was expected that after that, the Pool balance would be transferred at MultiSourceLoan, so _getUndeployedAssets() becomes smaller and exchangeRate returns to normal. But if its possible to do callback malicious logic before MultiSourceLoan transfers away the Pool balance, its possible to take advantage of this exchangeRate that becomes larger.
Example:
Suppose _getUndeployedAssets() = 1000, _getTotalOutstandingValue() = 1000 and totalSupply = 2000.
So:
totalAssets() = 2000
exchangeRate = 1:1
Manipulating the exchangeRate to redeem additional assets.
In validateOffer(), restrict offer.validators to be an empty array to avoid callbacks.
Context
0xend (Gondi) confirmed
Gondi mitigated:
Status: Mitigation confirmed. Full details in reports from oakcobalt, minhquanym and bin2chen.
