Missing slippage tollernace will lead to sandwich attacks
Summary
When the Fees::sellProfits is called, there is a high probability that it will get sandwiched by MEV bots.
Vulnerability Details
The Fees::sellProfits has a hardcoded amountOutMinimum parameter that is equal to 0. This means that when the swap is executed, we are fine with receiving any amount of tokens back (even 0). This can be exploited with the infamous "sandwich" attack, especially in low liquidity pools, where the price is easy to manipulate.
Impact
The protocoll will receive much less funds that it should have, due to the 100% slippage tollerance.
Tools Used
Manual review
Recommendations
Add a function parameter to for the amountOutMinimum value, so it can be set manually on each function call, instead of hardcoding it to 0.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.