The configurator.getEUSDMaxLocked() Condition Can Be Bypassed During a Flashloan
When converting `EUSD` tokens to `peUSD`, there is a check that limits the total amount of `EUSD` that can be converted:\\n```\\nfunction convertToPeUSD(address user, uint256 eusdAmount) public {\\n require(\\_msgSender() == user || \\_msgSender() == address(this), "MDM");\\n require(eusdAmount != 0, "ZA");\\n require(EUSD.balanceOf(address(this)) + eusdAmount <= configurator.getEUSDMaxLocked(),"ESL");\\n```\\n\\nThe issue is that there is a way to bypass this restriction. An attacker can get a flash loan (in EUSD) from this contract, essentially reducing the visible amount of locked tokens (EUSD.balanceOf(address(this))).
Multiple approaches can solve this issue. One would be adding reentrancy protection. Another one could be keeping track of the borrowed amount for a flashloan.
```\\nfunction convertToPeUSD(address user, uint256 eusdAmount) public {\\n require(\\_msgSender() == user || \\_msgSender() == address(this), "MDM");\\n require(eusdAmount != 0, "ZA");\\n require(EUSD.balanceOf(address(this)) + eusdAmount <= configurator.getEUSDMaxLocked(),"ESL");\\n```\\n