MIMOEmptyVault.sol executeOperation() does not transfer the Vault leftover assets to the owner, it is locked in the MIMOEmptyVault

Lines of code Vulnerability details Impact MIMOEmptyVault.sol executeAction is supposed to pay off the debt and return the leftover assets to the owner of the Vault But In fact the emptyVault contract, after executing the executionOperation, only pays back the flash loan, and does not transfer th...

Attacker can empty vaults

Lines of code Vulnerability details Impact Both MIMOEmptyVault and MIMOLeverage contracts share same signature/definition, an attacker can gain control of EmptyVault contract, issue a flash loan, and empty the vaults. Proof of Concept See the test below. In below test, EmptyVault contract is...