Summary

ERC77 define hooks before and after all interaction with the token, before transfer and after transfer, will allow attacker to reenter the pool contract.

Vulnerability Details

The attacker can reenter the contract whenever the pool does transfer from/to the user, the possibilities are unlimited when the attacker can reenter the contract.

For example

Attacker add liquidity, the attack steps can be like

1. pool transfers weth from the attacker to the pool

2. hook is called on the attacker contract after the transfer of funds and he can reenter now

3. the amount of weth in the pool is high now, the price of weth is low, the price of poolToken is higher.

4. attacker swap poolTokens for weth at higher price, making profit.

5. end of reentrancy

6. the pool transfer poolTokens from the attacker to the pool to complete the deposit.

Impact

Attacker can drain the whole pool.

Tools Used

Manual review.

Recommendations

Either disallow tokens with hooks, or add reentrance protection.