Frontrunning attacks by the owner
There are few possible attack vectors by the owner:\\nAll strategies have fees from rewards. In addition to that, the PancakeSwap strategy has deposit fees. The default deposit fees equal zero; the maximum is limited to 5%:\\n```\\nuint256 constant MAXIMUM\\_DEPOSIT\\_FEE = 5e16; // 5%\\nuint256 constant DEFAULT\\_DEPOSIT\\_FEE = 0e16; // 0%\\n  \\nuint256 constant MAXIMUM\\_PERFORMANCE\\_FEE = 50e16; // 50%\\nuint256 constant DEFAULT\\_PERFORMANCE\\_FEE = 10e16; // 10%\\n```\\n\\nWhen a user deposits tokens, expecting to have zero deposit fees, the `owner` can frontrun the deposit and increase fees to 5%. If the deposit size is big enough, that may be a significant amount of money. 2. In the `gulp` function, the reward tokens are exchanged for the reserve tokens on the exchange:\\n```\\nfunction gulp(uint256 \\_minRewardAmount) external onlyEOAorWhitelist nonReentrant\\n{\\n  uint256 \\_pendingReward = \\_getPendingReward();\\n  if (\\_pendingReward > 0) {\\n      \\_withdraw(0);\\n  }\\n  {\\n      uint256 \\_totalReward = Transfers.\\_getBalance(rewardToken);\\n      uint256 \\_feeReward = \\_totalReward.mul(performanceFee) / 1e18;\\n      Transfers.\\_pushFunds(rewardToken, collector, \\_feeReward);\\n  }\\n  if (rewardToken != routingToken) {\\n      require(exchange != address(0), "exchange not set");\\n      uint256 \\_totalReward = Transfers.\\_getBalance(rewardToken);\\n      Transfers.\\_approveFunds(rewardToken, exchange, \\_totalReward);\\n      IExchange(exchange).convertFundsFromInput(rewardToken, routingToken, \\_totalReward, 1);\\n  }\\n  if (routingToken != reserveToken) {\\n      require(exchange != address(0), "exchange not set");\\n      uint256 \\_totalRouting = Transfers.\\_getBalance(routingToken);\\n      Transfers.\\_approveFunds(routingToken, exchange, \\_totalRouting);\\n      IExchange(exchange).joinPoolFromInput(reserveToken, routingToken, \\_totalRouting, 1);\\n  }\\n  uint256 \\_totalBalance = Transfers.\\_getBalance(reserveToken);\\n  require(\\_totalBalance >= \\_minRewardAmount, "high slippage");\\n  \\_deposit(\\_totalBalance);\\n}\\n```\\n\\nThe `owner` can change the `exchange` parameter to the malicious address that steals tokens. The `owner` then calls `gulp` with `_minRewardAmount==0`, and all the rewards will be stolen. The same attack can be implemented in fee collectors and the buyback contract.
Resolution\\nThe client communicated this issue was addressed in commit 34c6b355795027d27ae6add7360e61eb6b01b91b.\\nUse a timelock to avoid instant changes of the parameters.
```\\nuint256 constant MAXIMUM\\_DEPOSIT\\_FEE = 5e16; // 5%\\nuint256 constant DEFAULT\\_DEPOSIT\\_FEE = 0e16; // 0%\\n  \\nuint256 constant MAXIMUM\\_PERFORMANCE\\_FEE = 50e16; // 50%\\nuint256 constant DEFAULT\\_PERFORMANCE\\_FEE = 10e16; // 10%\\n```\\n