Closed pandadefi closed 2 years ago
Did a review on latest changes focusing more on attack vectors around principal vault token, and malicious user can get a hold of more gauge shares than they have, could not identified any specific attack to withdraw more capital than deposited on my last review.
Regarding rewards given that the design change introduces a transfer mechanism that needs accounting logic too, im less certain theres no way to game rewards in favor of a user, we suggested adding some test cases around possible transfer attacks to validate this.
Also not entirely certain the kick function can be enough mitigation for stopping abuse of boosted rewards from flashloan attacks, it may be needed to control deposit limits around intended gauge assets at the vault level to mitigate this particular "flash boost" attack for gaining more rewards.
Description
Make Gauge IERC4626 compliant.
Checklist