No slippage control in liquidate() function
Summary
The function liquidate() does not have any slippage control.
Vulnerability Details
The function liquidate() does not have any slippage control. If the price retrieved by the oracle is manipulated, this can result in loss for the user as they would receive a very low amount of assets in return for the liquidation.
Impact
Loss for the user as they would receive a very low amount of assets in return for the the liquidation.
Tools Used
Vscode
Recommendations
Add a uint amountOut parameter to the function liquidate() which lets user provide the least Amount of Stable Coin they would accept for the provided tokenAmount. Then proceed with mint only if assetAmount > amountOut
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.