Notional Leveraged Vaults: Pendle PT and Vault Incentives: Malicious users can steal reward tokens via re-entrancy attack

A Notional leveraged-vault reward accounting path lets a user over-claim reward tokens through a callback-driven reentrancy. During a redemption, the account's reward debt is written down and reward tokens transferred before the on-chain share balance is final …