Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of slippage protection is compound()

0xasen

Summary

There is a lack of slippage protection in compound() when swapping tokens.

Vulnerability Details

Let's take a look at this part of the code in the compound() function:

ISwap.SwapParams memory _sp;
​
_sp.tokenIn = cp.tokenIn;
_sp.tokenOut = cp.tokenOut;
_sp.amountIn = _tokenInAmt;
_sp.amountOut = 0; // amount out minimum calculated in Swap
_sp.slippage = self.minSlippage;
_sp.deadline = cp.deadline;
​
GMXManager.swapExactTokensForTokens(self, _sp);

We're passing amountOut = 0 to swapExactTokensForTokens where we swap an exact amount of tokenIn for as many possible amount of tokenOut.

So amountOut is the minimum amount of tokenOut that we're ready to receive. There is a comment saying that amount out minimum is calculated in the Swap but that is not actually present.

The way it is currently implemented it's possible to receive 0 tokenOut if there's a lack of liquidity or bad market conditions.

swapExactTokensForTokens in GMXManager just passes the call to GMXWorker:

function swapExactTokensForTokens(
GMXTypes.Store storage self,
ISwap.SwapParams memory sp
) external returns (uint256) {
if (sp.amountIn > 0) {
return GMXWorker.swapExactTokensForTokens(self, sp);
} else {
return 0;
}
}

And GMXWorker just passes the call to the swapRouter:

function swapExactTokensForTokens(
GMXTypes.Store storage self,
ISwap.SwapParams memory sp
) external returns (uint256) {
IERC20(sp.tokenIn).approve(address(self.swapRouter), sp.amountIn);
​
return self.swapRouter.swapExactTokensForTokens(sp);
}

Impact

In bad market conditions, swaps could be performed at a very bad rate and funds will be lost.

Tools Used

Manual review

Recommendations

Calculate how much tokenOut minimum is sensible to receive and pass that as a parameter.

Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.