Ondo Finance V2

An attacker can sandwich-attack every time `SushiStakingV2Strategy.harvest(...)` is called by mid-term depositing LP tokens before the harvest (receiving tranche tokens). The attacker proceeds to withdraw the tranche share tokens for an increased amount of LP tokens.

The constants used in the `calculateSwapInAmount()` function depend on the fees charged by Uniswap and SushiSwap. Changes in fees by these protocols would lead to incorrect calculations.

Contract `SushiStakingV2Strategy` shares a lot of commonality with `SushiStrategyLP`, but duplicated code appears in both contracts. Not only this adds extra maintenance, but also can lead to incorrect bug fixing if fixes are done in one strategy, but not the other.

The`rewardPaths` array should have two paths. It seems one path should end in `token0` and the other in `token1` (or vice-versa). However, the implementation in `SushiStakingV2Strategy.addPool(...)`, both paths could end in `token0` or `token1`. It is unclear if the latter situation is indeed desired; our understanding is that **only** the first case should be allowed.

The constructor of `SushiStakingV2Strategy` does not validate whether the input addresses are indeed contracts; same with `SushiStakingV2Strategy.addPool(...)` and `AlchemixUserReward.constructor(...)`. Hence, incorrect setups could lead the contract to misbehave.

Not including the minimum out values and setting its value to zero when executing an external call to Sushiswap might result in a failing transaction due to bots not recognizing that a transaction may fail later on. This issue depends on how the attack bots are implemented.

The `SushiStakingV2Strategy.depositIntoChef(...)` calls `_compound()` before reaching the block in L497-500, in which the following calculation s performed: ``` uint256 shares = (_amount * poolData.totalShares) / poolData.totalLp ``` If `poolData.totalLp` is an extremely small value (for example, because of some dust generated from calling `_compound()`), this may lead to an extremely large value being stored in the `shares` variable. A similar issue is present in `withdrawFromChef(...)`.

Many operations in `SushiStakingV2Strategy` rely on a strategist role. A vault's strategist is responsible for correctly executing most of the vault and strategy actions and needs to be trusted. Even when assuming full trust in strategists, `SushiStakingV2Strategy` would be at risk if strategists get compromised.