Not using slippage parameter while swapping on UniswapV3
Summary
While making a swap on UniswapV3 the caller should use the slippage parameter amountOutMinimum to avoid losing funds.
Vulnerability Details
ISwapRouter.ExactInputSingleParams() in Fees.sol contract does not use the slippage parameter amountOutMinimum .
amountOutMinimum is used to specify the minimum amount of tokens the caller wants to be returned from a swap. Using amountOutMinimum = 0 tells the swap that the caller will accept a minimum amount of 0 output tokens from the swap, opening up the user to a catastrophic loss of funds via MEV bot sandwich attacks.
Impact
Loss of funds and not getting the correct amount of tokens in return.
Tools Used
Manual review
Recommendations
Use parameter amountOutMinimum correctly to avoid loss of funds.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.