Users can abuse discrepancies between oracle and true asset price to mint more OHM than needed and profit from it
All chainlink oracles have a deviation threshold between the current price of the asset and the on-chain price for that asset. The more oracles used for determining the price the larger the total discrepancy can be. These can be combined and exploited to mint more OHM than expected and profit.\\nBLVaultLido.sol#L156-L171\\n```\\n    uint256 ohmWstethPrice = manager.getOhmTknPrice();\\n    uint256 ohmMintAmount = (amount_ * ohmWstethPrice) / _WSTETH_DECIMALS;\\n\\n    // Block scope to avoid stack too deep\\n    {\\n        // Cache OHM-wstETH BPT before\\n        uint256 bptBefore = liquidityPool.balanceOf(address(this));\\n\\n        // Transfer in wstETH\\n        wsteth.safeTransferFrom(msg.sender, address(this), amount_);\\n\\n        // Mint OHM\\n        manager.mintOhmToVault(ohmMintAmount);\\n\\n        // Join Balancer pool\\n        _joinBalancerPool(ohmMintAmount, amount_, minLpAmount_);\\n```\\n\\nThe amount of OHM to mint and deposit is determined by the calculated price from the on-chain oracle prices.\\nBLVaultLido.sol#L355-L364\\n```\\n    uint256[] memory maxAmountsIn = new uint256[](2);\\n    maxAmountsIn[0] = ohmAmount_;\\n    maxAmountsIn[1] = wstethAmount_;\\n\\n    JoinPoolRequest memory joinPoolRequest = JoinPoolRequest({\\n        assets: assets,\\n        maxAmountsIn: maxAmountsIn,\\n        userData: abi.encode(1, maxAmountsIn, minLpAmount_),\\n        fromInternalBalance: false\\n    });\\n```\\n\\nTo make the issue worse, _joinBalancerPool use 1 for the join type. This is the EXACT_TOKENS_IN_FOR_BPT_OUT method of joining. What this means is that the join will guaranteed use all input tokens. If the current pool isn't balanced in the same way then the join request will effectively swap one token so that the input tokens match the current pool. Now if the ratio is off then too much OHM will be minted and will effectively traded for wstETH. This allows the user to withdraw at a profit once the oracle has been updated the discrepancy is gone.
The vault needs to have withdraw and/or deposit fees to make attacks like this unprofitable.
Users can always time oracles so that they enter at an advantageous price and the deficit is paid by Olympus with minted OHM
```\\n    uint256 ohmWstethPrice = manager.getOhmTknPrice();\\n    uint256 ohmMintAmount = (amount_ * ohmWstethPrice) / _WSTETH_DECIMALS;\\n\\n    // Block scope to avoid stack too deep\\n    {\\n        // Cache OHM-wstETH BPT before\\n        uint256 bptBefore = liquidityPool.balanceOf(address(this));\\n\\n        // Transfer in wstETH\\n        wsteth.safeTransferFrom(msg.sender, address(this), amount_);\\n\\n        // Mint OHM\\n        manager.mintOhmToVault(ohmMintAmount);\\n\\n        // Join Balancer pool\\n        _joinBalancerPool(ohmMintAmount, amount_, minLpAmount_);\\n```\\n