Rubicon: REENTRANCY ATTACK POSSIBLE IF THE `_feeTo` IS A MALICIOUS CONTRACT IN `FeeWrapper._chargeFeePayable()` FUNCTION

Rubicon's FeeWrapper forwards protocol fees to a caller-supplied `_feeTo` address via a low-level `.call` that performs no state update before the transfer and checks no invariant that the deposited msg.value exceeds the fee being paid. A fee recipient contrac …