The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The slippage protection value is calculated incorrectly

Bauer

Summary

A potential vulnerability to Sandwich Attacks exists in some function in the protocol.

Vulnerability Details

In the swap() function, the slippage is determined by the minimumAmountOut parameter in ISwapRouter.ExactInputSingleParams(). This value is calculated through the calculateMinimumAmountOut() function. If collateralValueMinusSwapValue >= requiredCollateralValue, then the slippage value will be 0. Otherwise, it is calculated as calculator.eurToToken(getToken(_outTokenSymbol), requiredCollateralValue - collateralValueMinusSwapValue).

​
function calculateMinimumAmountOut(bytes32 _inTokenSymbol, bytes32 _outTokenSymbol, uint256 _amount) private view returns (uint256) {
ISmartVaultManagerV3 _manager = ISmartVaultManagerV3(manager);
uint256 requiredCollateralValue = minted * _manager.collateralRate() / _manager.HUNDRED_PC();
uint256 collateralValueMinusSwapValue = euroCollateral() - calculator.tokenToEur(getToken(_inTokenSymbol), _amount);
return collateralValueMinusSwapValue >= requiredCollateralValue ?
0 : calculator.eurToToken(getToken(_outTokenSymbol), requiredCollateralValue - collateralValueMinusSwapValue);
}

The slippage protection is incorrect as a slippage value of 0 implies no protection, making the transaction vulnerable to sandwich attacks. Even if it's not 0, the slippage protection value is still incorrect. This value should be calculated off-chain based on the input quantity and then passed as a parameter to the function.

Impact

Users face potential asset losses due to vulnerabilities like front-running, sandwich, or transaction reordering attacks.

Tools Used

Vscode

Recommendations

Implementing validation for minimum amounts within the code can enhance user protection against such exploitative scenarios.

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Slippage-issue

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Slippage-issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!