BlockDev Sp. Z o.o: Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`

Summary: The flap contract provides the ability to auction DAI for MKR. That's a fundamental functionality of the MCD system, invoked usually from the vow contract. A flaw in the validation of calls to flap.kick, however, allows a malicious user to create "fake' auctions that can be later used to...