Vulnerable to slippage attacks during emergencyPause
Summary
There is a risk of a slippage attack when removing liquidity in the emergencyPause function without setting a slippage point.
Vulnerability Details
Contracts have slippage set in many places, but there are many places where slippage is not set in order to keep the program from failing to run, which makes slippage attacks risky. For example, when emergencyPause is in place, it is susceptible to a slippage attack.
Impact
Emergency withdrawals can easily cause a loss in the contract.
Tools Used
manual
Recommendations
It is recommended to still set slippage to avoid huge losses. Or at least leave the interface to be able to set slippage, even if you choose not to use it in case of emergency.
Lead Judging Commences
Slippage protection on emergency Pause/Resume
Impact: High Likelihood: Low Because the whole lpToken balance is used during the emergency process, the impact is high. But the likelihood is LOW because of the dependence on the emergency.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.