Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

No slippage check when swapping tokens to WETH

peanuts

Summary

There is no slippage protection when swapping tokens to WETH. During times of high market turbulence or low liquidity pools, the swap may not be as ideal.

Vulnerability Details

sellProfits() in Fees.sol does not have any slippage check because it uses amountOutMinimum as 0. amountOutMinimum is used to specify the minimum amount of tokens the caller wants to be returned from a swap. Using amountOutMinimum = 0 tells the swap that the caller will accept a minimum amount of 0 output tokens from the swap, opening up the user to a catastrophic loss of funds via MEV bot sandwich attacks.

function sellProfits(address _profits) public {
require(_profits != WETH, "not allowed");
uint256 amount = IERC20(_profits).balanceOf(address(this));
​
​
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});

Impact

Loss of funds and not getting the correct amount of tokens in return.

Tools Used

Manual Review

Recommendations

Use parameters amountOutMinimum correctly to avoid loss of funds.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.