Beedle - Oracle free perpetual lending

Summary

In Fees.sol, sellProfits function is vulnerable for sandwich attack.

Vulnerability Details

sellProfits function can be called by anyone, and also it doesn't require any minimum output amount, so the attacker can try sandwich attack.

Impact

Profits will be sold at lower price.

Tools Used

Manual Review

Recommendations

Update sellProfits to be callable only by admin or owner, also add a new parameter minOutputAmount which will be passed to the SwapRouter.