UniswapHelper.buyFlanAndBurn is a subject to sandwich attacks

Handle hyh Vulnerability details Impact Trades can happen at a manipulated price and end up receiving fewer Flan to be bought than current market price dictates. For example, at the time a user decides to call buyFlanAndBurn Flan trades at 0.8 in the input token terms at the corresponding DEX poo...

IndexPool._pow wrong loop and does not normalize values

Handle cmichel Vulnerability details The IndexPool.compute function is indented as if the if n % 2 != 0 output = output a; is inside the loop but there are actually not braces around it. It must be in the loop for the exponentiation by repeated squaring algorithm to work: function powuint256 a,...