Beedle - Oracle free perpetual lending

Summary

The sellProfits function might be vulnerable to front running attacks as it broadcasts the swap information publicly.
Malicious users can take advantage of this information to manipulate the market price.

Vulnerability Details

In a front-running attack, a malicious actor can observe the transaction pending in the mempool and then broadcast
a similar transaction with a higher gas price to have it mined before yours. This can be particularly harmful in trading scenarios as it can affect the price you receive.

Impact

In the function sellProfits, the attacker could see the pending transaction to sell _profits for WETH and could then make a similar transaction with a higher gas price to sell _profits for WETH before the transaction gets mined. This could potentially decrease the amount of WETH that would be received from the sale.

Tools Used

Manual review

Recommendations

To mitigate front-running attacks, it is recommendet to implement some form of transaction ordering control (TOC) or using a commit-reveal scheme.