Summary

The liquidate function in the DSCEngine contract presents a front-run risk. This vulnerability may allow attackers to exploit pending transactions for illicit profit.

Vulnerability Details

The liquidate function allows users to cover debts and redeem collateral with a 10% bonus. However, it lacks preventative measures against front running, allowing an attacker to view the pending transaction, duplicate the transaction, and increase the gas fee to be confirmed first. This could cause the original user to lose the settlement opportunity and any gas spent.

Impact

Medium

Tools Used

Manual code review

Recommendations

I can recomender use confidential transact like Flashbots.