Lack of slippage protection while swapping on UniswapV3
Summary
In Fees.sol the sellProfits function executes swaps on UniswapV3 without slippage protection. That will cause a loss of funds because of sandwich attacks.
Vulnerability Details
In Fees.sol the sellProfits function amountOutMinimum parameter is used to specify the minimum amount of tokens the caller wants to be returned from a swap. Using amountOutMinimum = 0 tells the swap that the caller will accept a minimum amount of 0 output tokens from the swap leading to loss of funds via MEV bot sandwich attacks.
Impact
Swaps in sellProfits function can be be sandwiched causing a loss of funds for the protocol.
Tools Used
Manual review
Recommendations
Let the user input/calculate proper amountOutMinimum value.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.