Submission Details
Severity:
Not having a minimum output amount is dangerous
Summary
Allowing to receive 0 in as trade amount can lead to front runs / sandwich attacks and the user losing huge amounts
Vulnerability Details
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});
Impact
Max slippage, MEV, losing assets in sandwich attacks
Tools Used
Manual
Recommendations
Set a non hardcoded minimum amount so users can set their own amounts
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.