Beedle - Oracle free perpetual lending

Summary

MEV can sandwich every Profit due to missing slippage tolerance value

Vulnerability Details

In fees.sol every time sellProfits methods was called the following code gets executed:

ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});

The “0” here is the value of the amountOutMinimum argument which is used for slippage tolerance. 0 value here essentially means 100% slippage tolerance. This is a very easy target for MEV and bots to do a flash loan sandwich attack on each of the strategy’s swaps, resulting in very big slippage on each trade.

Impact

100% slippage tolerance can be exploited in a way that the strategy (so the profit and the users) receive much less value than it should had. This can be done on every trade if the trade transaction goes through a public mempool.

Tools Used

Manual Test

Recommendations

The best solution here is to make the sellProfits method of the vault be callable only by a list of trusted addresses which will send the transaction through a private mempool. This, combined with an on-chain calculation for an amountOutMinium that is off from the expected amount out by a slippage tolerance percentage (that might be configurable through a setter in the strategy) should be good enough to protect you from MEV sandwich attacks.