Submission Details
Severity:
The owner of SmartVault doesn't have a say on `minimumAmountOut` hence `swap` function could be target to front run
Summary
The owner of SmartVault doesn't have a say on minimumAmountOut
Vulnerability Details
MEV - Miner could potentially front-run this swap function in SmartVaultV3.sol so that the legitimate caller can end up with less than deserved minimumAmountOut. In other words, this function appears to be susceptible to oracle manipulation attacks.
function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: _amount - swapFee,
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) :
executeERC20SwapAndFee(params, swapFee);
}
Impact
The owner of SmartVault can end up with less than deserved minimumAmountOut
Tools Used
Manual Review
Recommendations
Allow the SmartVault holder to specify desired minimumAmountOut like follows
+ function max(uint256 a, uint256 b) private pure returns(uint256) {
+ return a < b ? b : a;
+ }
- function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
+ function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount, uint256 _minAmountOut) external onlyOwner {
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: _amount - swapFee,
- amountOutMinimum: minimumAmountOut,
+ amountOutMinimum: max(minimumAmountOut, _minAmountOut),
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) :
executeERC20SwapAndFee(params, swapFee);
}
Updates
Lead Judging Commences
hrishibhat almost 2 years ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
Slippage-issue
informational/invalid
heavenz52
almost 2 years ago
hrishibhat
over 1 year ago
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Slippage-issue
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.