Beedle - Oracle free perpetual lending

Summary

In Fees.sol, the function sellProfits() which is used to swap loan tokens for collateral tokens(WETH) from liquidations doesn't have slippage protection making it vulnerable to sandwich attacks.

Vulnerability Details

Given that both amountOutMinimum and sqrtPriceLimitX96 are set to 0, there is no slippage protection, meaning the contract will definitely get exploited via a sandwich attack while trying to swap.

In this context, amountOutMinimum is the minimum amount of tokens(WETH) we are ready to receive and it is currently hardcoded to 0.

For more information about sqrtPriceLimitX96 and slippage protection read here.

These attacks are extremely common, and many MEV bots are looking exactly for this kind of unsafe swaps, making the chance of getting sandwiched extremely high.

Impact

Loss of funds from sandwich attack when swapping tokens because of lack of slippage control

Tools Used

Manual review

Recommendations

Calculate the amountOutMinimum earlier in the function or pass it as a parameter. Then check if the contract received the required tokens.