Beedle - Oracle free perpetual lending

Summary

Hard-coded "0" slippage can cause loss to Fees.sellProfits() operation by sudden price fluctuation or sandwich attacks.

Impact and Vulnerability Details

1- Fees.sellProfits() transaction is signed and broadcasted and is pending in the mempool which contains swap() for UNISWAP V3.

2- amountOutMinimum=0 inside the swap transaction allows for significant slippage.

3- A MEV bot detects the pending transaction. Since the amountOutMinimum=0 value allows for high slippage, the bot sandwiches the Fees.sellProfits() transaction resulting in significant profit for the bot and significant loss for the Protocol.

Similar Issue

https://solodit.xyz/issues/m-01-missing-deadline-checks-allow-pending-transactions-to-be-maliciously-executed-code4rena-backed-protocol-papr-contest-git

Tools Used

Manual Review

Recommendations

Introduce user controlled amountOutMin parameter like below and pass it inside ExactInputSingleParams struct for amountOutMinimum instead of passing hard-coded zero.

```function sellProfits(address _profits, uint256 amountOutMin) public {....}```