Submission Details
Severity:
Missing slippage checks
Summary
Missing slippage checks
Vulnerability Details
The following functions lack slippage protection and they are exposed to front-running, which will lead to the user losing their funds as they get sandwiched.
https://docs.uniswap.org/contracts/v3/guides/swaps/single-swaps#swap-input-parameters amountOutMinimum: we are setting to zero, but this is a significant risk in production.
Impact
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,//@audit
sqrtPriceLimitX96: 0
});
amount = swapRouter.exactInputSingle(params);
Tools Used
vscode
Recommendations
It is recommended that amountOutMinimum be 99% of amout
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.