Beedle - Oracle free perpetual lending

Summary

By using Fees::sellProfits, any amount of fees that are accumulated up to that point in it will be swapped for WETH and sent to the staking contract.

The function does not allow users to supply their own deadline as the deadline parameter when calling UniswapV3 swap. Is simply passed in as current block.timestamp in which transaction occurs. This effectively means that transaction has no deadline, which means that swap transaction may be included anytime by validators and remain pending in mempool, potentially exposing users to sandwich attacks by attackers or MEV bots or leading to token loss due to lower prices .

Vulnerability Details

Swapping is done using Uniswap V3 router (ISwapRouter) with the following swap arguments:

Leaving deadline as block.timestamp .

Consider the following scenario:

• alice wants to transfer any protocol fee revenue to the staking contract, she initiates a sell

• transaction is submitted to the mempool, however, alice chose a transaction fee that is too low for validators to be interested in including her transaction in a block.

• transaction stays pending in the mempool for extended periods, which could be hours, days, weeks, or even longer

• when the average gas fee dropped far enough for alice's transaction to become interesting again for miners to include it, her swap will be executed. In the meantime, the price of fee reward token could have drastically decreased. She has unknowingly performed a bad trade due to the pending transaction she forgot about.

Impact

Protocol fee rewards will be lost due to sandwich attacks.

Tools Used

Manual review and usage of other similar findings.

Recommend Mitigation

Allow users to supply their own deadline parameter.