Steadefi

Summary

addLiquidity && removeLiquidity in the emergencyResume and emergencyPause functions do not check the minimum liquidity amounts. This makes vault funds vulnerable to sandwich attacks.

Vulnerability Details

During an emergency pause, the removeLiquidity function is called without specifying the minimum amount for long and short tokens that must be received (minLongTokenAmount and minShortTokenAmount). This exposes the transaction to potential sandwich attacks, where an attacker can manipulate the market price by performing trades before and after the transaction. The same vulnerability is present in the emergencyResume function with addLiquidity, where liquidity is added back without checking for minimum amounts, making it possible for an attacker to extract value.

Exemple :

Since minTokenAAmt and minTokenBAmt are not defined, the _rlp.minTokenBAmt and _rlp.minTokenAAmt have the default value 0. Which makes this transaction vulnerable to MEV Bots. Same thing for for the emergencyResume function where minMarketTokenAmt is not defined for addingLiquidity.

Impact

High. The lack of minimum amount checks can lead to significant financial loss as attackers can drain the value from the transactions.

Tools Used

Manual Review

Recommendations

Define and enforce minimum amounts for long, short tokens and LP tokens as function parameters when calling removeLiquidity and addLiquidity during emergency procedures to prevent exploitation through sandwich attacks.