Beedle - Oracle free perpetual lending

Summary

sellProfits are forced to allow unlimited slippage

Vulnerability Details

 function sellProfits(address _profits) public {
    require(_profits != WETH, "not allowed");
    uint256 amount = IERC20(_profits).balanceOf(address(this));

    ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
        .ExactInputSingleParams({
            tokenIn: _profits,
            tokenOut: WETH,
            fee: 3000,
            recipient: address(this),
            deadline: block.timestamp,
            amountIn: amount,
            amountOutMinimum: 0,
            sqrtPriceLimitX96: 0
        });

    amount = swapRouter.exactInputSingle(params);
    IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)));
}

sellProfits in Fees contract does not use the slippage parameter amountOutMinimum
amountOutMinimum is used to specify the minimum amount of tokens the caller wants to be returned from a swap. Using amountOutMinimum = 0 tells the swap that the caller will accept a minimum amount of 0 output tokens from the swap, opening up the user to a catastrophic loss of funds via MEV bot sandwich attacks.

Impact

anyone with enough capital can force arbitrarily large slippage by sandwiching transactions, close to 100%.

Tools Used

manual review

Recommendations

Recommend adding a minimum amount out parameter. The function reverts if the minimum amount isn't obtained