Submission Details
Severity:
Fees swaps can be MEV'ed
Summary
A MEV bot can steal from swap and return none WETH tokens to Fees contract.
Vulnerability Details
The amountOutMinimum parameter in ExactInputSingleParams is necessary to calculate the expected amount of WETH tokens that the Fees contract will receive. By setting it to zero, any MEV bot can extract value from this transaction, leading to loss of rewards for users.
Impact
Loss of users rewards to MEV bot.
Tools Used
Manual Review
Recommendations
It is recommended to add a variable to use as amountOutMinimum or calculate it.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.