Description:
LoopedVault::rebalance() is missing the nonReentrant modifier. LoopedVault::requestWithdraw() flow when there are not enough idle funds also never checks for reentrancy. It only does when withdrawing as it calls LoopedVault::_withdraw(), which does have the modifier. LoopedVault::fulfillWithdraw() is missing the nonReentrant modifier.
Recommended Mitigation:
Add the nonReentrant modifier to LoopedVault::requestWithdraw() and remove it from LoopedVault::_withdraw().
0xSimao:
Fixed in #2a378db.