There is a risk of a sandwich attack during emergencyResume.
Summary
During emergencyResume, minMarketTokens, which is a parameter originally required in addLiquidity, is not set and is set to zero. This prevents slippage from being taken into account, making it a target of a sandwich attack.
Vulnerability Details
minMarketTokens: alp.minMarketTokenAmt is usually specified in AddLiquidityParams, which is the argument to this function. However, this parameter is not specified in emergencyResume. In other words, it is set to zero, and the minimum token value is not set, making it subject to a sandwich attack.
Impact
Sandwich attack will result in a deal with very unfavorable terms
Tools Used
Manual
Recommendations
Allow minMarketTokenAmt to be set as an argument to emergencyResume
Lead Judging Commences
Slippage protection on emergency Pause/Resume
Impact: High Likelihood: Low Because the whole lpToken balance is used during the emergency process, the impact is high. But the likelihood is LOW because of the dependence on the emergency.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.