The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Executing `SmartVaultV3` swaps becomes impractical when the collateral exceeds the required amount.

tricko

Summary

During the calculation of minAmountOut, if collateralValueMinusSwapValue is greater than or equal to the required collateral value, minAmountOut is set to zero. This makes the swap susceptible to high slippage, potentially leading to a loss of funds for the vault owners.

Vulnerability Details

When SmartVaultV3.swap() is called, the minAmountOut parameter is calculated on-chain by the SmartVaultV3;calculateMinimumAmountOut() function (shown below).

function calculateMinimumAmountOut(bytes32 _inTokenSymbol, bytes32 _outTokenSymbol, uint256 _amount) private view returns (uint256) {\
ISmartVaultManagerV3 _manager = ISmartVaultManagerV3(manager);
uint256 requiredCollateralValue = minted * _manager.collateralRate() / _manager.HUNDRED_PC();
uint256 collateralValueMinusSwapValue = euroCollateral() - calculator.tokenToEur(getToken(_inTokenSymbol), _amount);
return collateralValueMinusSwapValue >= requiredCollateralValue ?
0 : calculator.eurToToken(getToken(_outTokenSymbol), requiredCollateralValue - collateralValueMinusSwapValue);
}

The function calculateMinimumAmountOut() verifies that the remaining collateral, after deducting the amount of tokens intended for the swap, exceeds the required collateral (minted * _manager.collateralRate() / _manager.HUNDRED_PC()). If this condition holds true, the resulting minAmountOut is set to zero. Consequently, the swap lacks any form of slippage control, making it prone to high slippage or, worse, becoming a target for sandwich MEV operators, resulting in significant losses for the vault owner.

Impact

Users with sufficient collateral, where collateralValueMinusSwapValue >= requiredCollateralValue, are unable to execute swaps without facing the risk of high slippage.

Tools Used

Manual Review

Recommended Mitigation

On those situations that (collateralValueMinusSwapValue >= requiredCollateralValue), consider allowing the minAmountOut be set by the function caller.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Slippage-issue

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Slippage-issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.