Beedle - Oracle free perpetual lending

Summary

minAmountOut for swap set to 0

Vulnerability Details

Fees.sol line 38 -> amountOutMinimum = 0
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});
Implies contract willing to receive any amount 0 and more from swap.

Impact

High: The above leads to MEV Bot Sandwich attacks leading to loss of fees for the protocol as can end up receiving 0 tokens from the swap
See resource "DeFi Slippage Attacks" with more links

Tools Used

Manual Analysis

Recommendations

It is recommended that amountOutMin be not be set as zero, be set based on Decentralized Price Oracle and or be made flexible by passing it in as a parameter etc