Beedle - Oracle free perpetual lending

Summary

DeFi platforms must allow users to specify a slippage parameter: the minimum amount of tokens they want to be returned from a swap, auditors should always be on the lookout for swaps which set slippage to 0

Vulnerability Details

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Fees.sol#L38
slippage is hardcoded to 0, this code tells the swap that the user will accept a minimum amount of 0 output tokens from the swap, opening up the user to a catastrophic loss of funds via MEV bot sandwich attacks.

Impact

fund loss for users who can't set their own slippage

Tools Used

Manual Review

Recommendations

Let user set their own slippage params, platforms should also provide a sensible default if the user doesn't specify a value, but user-specified slippage parameters must always override platform defaults.