✅ They should calculate the period user deposited

[illustrate] Understanding MasterChef.sol

Solving!

		uint256 totalDeposits = accToken.totalSupplyAt(lastSnapshotIdForRewards);
    uint256 amountDeposited = accToken.balanceOfAt(
      msg.sender,
      lastSnapshotIdForRewards
    );

msg.senderのbalanceOfAtで決まる

using flash loand depositされている量をその瞬間に増やす

その瞬間だけ

すでにあるpoolのtokenを全て借りてclaimする

When this function is called?

In that’s time, executing the flashLoan and deposit!

deposit ⇒ distributeRewards

They

//When, this condition is true, executing!

block.timestamp >=
      lastRecordedSnapshotTimestamp + REWARDS_ROUND_MIN_DURATION;
  }

You should use TWAP to prevent hacking from hacker

Hacker can get a lot Gov Token using the chance of adding the reward timing by flashloan.