yearn / veYFI

Voting YFI
75 stars 38 forks source link

try out IERC4626 #155

Closed pandadefi closed 2 years ago

pandadefi commented 2 years ago

Description

Make Gauge IERC4626 compliant.

Checklist

storming0x commented 2 years ago

Did a review on latest changes focusing more on attack vectors around principal vault token, and malicious user can get a hold of more gauge shares than they have, could not identified any specific attack to withdraw more capital than deposited on my last review.

Regarding rewards given that the design change introduces a transfer mechanism that needs accounting logic too, im less certain theres no way to game rewards in favor of a user, we suggested adding some test cases around possible transfer attacks to validate this.

Also not entirely certain the kick function can be enough mitigation for stopping abuse of boosted rewards from flashloan attacks, it may be needed to control deposit limits around intended gauge assets at the vault level to mitigate this particular "flash boost" attack for gaining more rewards.