Beedle - Oracle free perpetual lending

Summary

The contract is missing slippage checks which can lead to being vulnerable to sandwich attacks.

Vulnerability Details

A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets the victim execute the trade, and then backruns (executes after) the victim by trading back the amount gained in the first trade. Intuitively, one uses the knowledge that someone’s going to buy an asset, and that this trade will increase its price, to make a profit. The attacker’s plan is to buy this asset cheap, let the victim buy at an increased price, and then sell the received amount again at a higher price afterwards.

See Fees.sellProfits():

Impact

Since everyone can trigger this function, an attacker can launch a sandwich attack with flashloan to steal the funds.

Tools Used

Manual

Recommendations

1. Add minimum return amount checks.

2. If the dev wants to make this a permissionless control, the contract should calculate a min return based on TWAP and check the slippage.