First Flight #9: Soulmate

Summary

MEV Attackers can preemptively call Vault::initVault, resulting in token theft

Vulnerability Details

After the deployment of the Vault contract, attackers can front-run the call to Vault::initVault(loveTokenAddress, attackerAddress), approve the LoveToken to their own address, thus stealing LoveToken.

Impact

There is a risk of 500,000,000 * 2 quantity of love tokens being stolen

Tools Used

manual review

Recommendations

In the Vault contract constructor call the initVault or add an owner permission to only allow the owner to call the Vault::initVault() function