Submission Details
Severity:
`sellProfits()` is not slippage protected
Summary
Uniswap swap done in sellProfits() can be sandwiched heavily.
Vulnerability Details
sellProfits() makes a Uniswap trade and sets amountOutMinimum to 0:
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});
Thus this trade succeeds even if the amount received from the swap is 0. This allows anyone to sandwich this trade for their own profit resulting in 0 WETH in sellProfits() Uniswap trade.
Impact
Any token sold via sellProfits() for WETH will result in a heavy loss.
Tools Used
Manual
Recommendations
Add a _amountOutMinimum parameter to sellProfits which is passed to amountOutMinimum. This ensures that the caller has control over the slippage.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.