Beedle - Oracle free perpetual lending

Summary

While making a swap on UniswapV3 the function should use the slippage parameter amountOutMinimum to avoid losing funds.

Vulnerability Details

The sellProfits function on the Fees contract allows swapping arbitrary tokens that the contract possesses to WETH. However, the function does not use the slippage parameter amountOutMinimum, which is meant to specify the minimum amount of tokens the caller wants to receive in return from the swap. Using amountOutMinimum = 0 tells the swap that the caller will accept a minimum amount of 0 output tokens from the swap, opening up the user to a catastrophic loss of funds via MEV bot sandwich attacks.

Impact

Loss of funds and not getting the correct amount of tokens in return.

Tools Used

Manual review.

Recommendations

Use parameters amountOutMinimum correctly to avoid loss of funds.