xERC4626 is vulnerable to exchange rate MEV:

Lines of code LOC: Vulnerability details Description When protocols hand out rewards to staked tokens, they must be careful to do so without leaving a large MEV opportunity, otherwise a bot could sandwich the increase of token value by minting shares and immediately redeeming them for a larger...

Wrong accounting logic when syncRewards() is called within beforeWithdraw makes withdrawals impossible

Lines of code Vulnerability details Impact sfrxETH.beforeWithdraw first calls the beforeWithdraw of xERC4626, which decrements storedTotalAssets by the given amount. If the timestamp is greater than the rewardsCycleEnd, syncRewards is called. However, the problem is that the assets have not been...

beforeWithdraw() call syncRewards() results in incorrect nextRewards

Lines of code Vulnerability details Impact beforeWithdraw call syncRewards cause the number of "nextRewards" to be incorrect . if a large amount is withdraw at the end of the cycle, then the next cycle reward will incorrectly increase by the corresponding amount Proof of Concept when call...