[NAZ-H1] syncRewards() Can be Front-Run With A Flashloan To Force lastRewardAmount To Equal Zero

Lines of code Vulnerability details Impact A malicious user can front run syncRewards with a flashloan attack to cause lastRewardAmount to equal zero. With this users will lose on rewards until the next rewardsCycleEnd. Proof of Concept 1. Alice calls deposit with 1000 tokens storedTotalAssets =...

[WP-H0] xERC4626.sol Some users may not be able to withdraw until rewardsCycleEnd the due to underflow in beforeWithdraw()

Lines of code Vulnerability details function beforeWithdrawuint256 amount, uint256 shares internal virtual override super.beforeWithdrawamount, shares; storedTotalAssets -= amount; function syncRewards public virtual uint192 lastRewardAmount = lastRewardAmount; uint32 timestamp =...