Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of slippage control, which allow an attacker to steal funds by the front-running / sandwich attack when swapping loan tokens for collateral tokens

0xmuxyz

Summary

Missing slippage control when swapping loan tokens for collateral tokens in the Fees#sellProfits(), which allow an attacker to steal funds by the front-running / sandwich attack when swapping loan tokens for collateral tokens in the Fees#sellProfits()

Vulnerability Details

Within the Fees#sellProfits(), 0 would always be assigned into the amountOutMinimum property as a argument of the params for swapping loan tokens for collateral tokens like this:
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Fees.sol#L38

/// @notice swap loan tokens for collateral tokens from liquidations
/// @param _profits the token to swap for WETH
function sellProfits(address _profits) public {
require(_profits != WETH, "not allowed");
uint256 amount = IERC20(_profits).balanceOf(address(this));
​
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0, /// @audit
sqrtPriceLimitX96: 0
});
​
amount = swapRouter.exactInputSingle(params);
IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)));
}

However, setting 0 to the amountOutMinimum property means no slippage control, which allow an attacker to steal funds by the front-running / sandwich attack when swapping loan tokens for collateral tokens in the Fees#sellProfits().

Impact

Lose of fund by front-running / sandwitch attack when swapping the loan token for the collateral token due to lack of slippage control.

Tools Used

  • Foundry

Recommendations

Within the Fees#sellProfits(), consider adding the _amountOutMinimum parameter and replacing the argument to be assigned into the amountOutMinimum property from 0 to the _amountOutMinimum so that a caller can specify their acceptable slippage parameter like this:

+ function sellProfits(address _profits, uint256 _amountOutMinimum) public {
- function sellProfits(address _profits) public {
require(_profits != WETH, "not allowed");
uint256 amount = IERC20(_profits).balanceOf(address(this));
​
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
+ amountOutMinimum: _amountOutMinimum,
- amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});
​
amount = swapRouter.exactInputSingle(params);
IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)));
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.