Submission Details
Severity:
sellProfits will lose users fund with 0 slippage
Summary
When sell profits, user will lose fund because protocol has no slippage protection.
Vulnerability Details
When user sell profits for ETH, protocol call uniswap v3 router exactInputSingle function to sell profits for ETH, but there is no slippage protection because amountOutMinimum is set to 0.
Impact
All profits tokens can be sandwiched and stolen by malicious MEV.
Tools Used
vscode, Manual Review
Recommendations
Allow users to specify slippage parameters for all profits tokens.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.