The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

SmartVaultV3.swap has bad slippage protection

rvierdiiev

Summary

SmartVaultV3.swap has bad slippage protection which can lead to loss of user's funds.

Vulnerability Details

Using SmartVaultV3.swap function user can swap one collateral token for another.
calculateMinimumAmountOut function is responsible to calculate slippage amount.

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/SmartVaultV3.sol#L206-L212

function calculateMinimumAmountOut(bytes32 _inTokenSymbol, bytes32 _outTokenSymbol, uint256 _amount) private view returns (uint256) {
ISmartVaultManagerV3 _manager = ISmartVaultManagerV3(manager);
uint256 requiredCollateralValue = minted * _manager.collateralRate() / _manager.HUNDRED_PC();
uint256 collateralValueMinusSwapValue = euroCollateral() - calculator.tokenToEur(getToken(_inTokenSymbol), _amount);
return collateralValueMinusSwapValue >= requiredCollateralValue ?
0 : calculator.eurToToken(getToken(_outTokenSymbol), requiredCollateralValue - collateralValueMinusSwapValue);
}

The main logic of this function is next: after the swap, vault should have not less than requiredCollateralValue, which is amount to collateralize minted tokens. So in case if even without swap amount contract has enough collateral, then function doesn't care about slippage and set it to 0. Otherwise it set it to the amount that is needed to reach collateralization.

Such approach is not good and allows sandwhich attacks against such swap. Result of this will be collateral loss for the vault's owner.

Impact

Swap is not protected against sandwhich attack

Tools Used

VsCode

Recommendations

Allow user to provide slippage for the swap. And then validate it to still be fully collateralized.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Slippage-issue

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Slippage-issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.