The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Slippage value is calculated on chain and set to `0%`

bauchibred

Proof of Concept

Take a look at SmartVaultV3.sol#L206-L212

function calculateMinimumAmountOut(bytes32 _inTokenSymbol, bytes32 _outTokenSymbol, uint256 _amount) private view returns (uint256) {
ISmartVaultManagerV3 _manager = ISmartVaultManagerV3(manager);
uint256 requiredCollateralValue = minted * _manager.collateralRate() / _manager.HUNDRED_PC();
uint256 collateralValueMinusSwapValue = euroCollateral() - calculator.tokenToEur(getToken(_inTokenSymbol), _amount);
//@audit
return collateralValueMinusSwapValue >= requiredCollateralValue ?
0 : calculator.eurToToken(getToken(_outTokenSymbol), requiredCollateralValue - collateralValueMinusSwapValue);
}
​
function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: _amount - swapFee,
//@audit
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) :
executeERC20SwapAndFee(params, swapFee);
}
​

As seen, for swaps to be processed the value of the minimum amount out is calculated on-chain and in a case where the collateral value mins swap fee is less than the required collateral value, the min amount out value is set to 0, otherwise this value is directly set to requiredCollateralValue - collateralValueMinusSwapValue now this traslates to protocol setting a 0% percent slippage for swap attempts, which goes against the idea of slippage and might lead to reverts in the attempt to swap.

Impact

Slippage being hardcoded, completely breaks logic of "slippage" and in some cases would cause reverts to occur while a swap is being attempted.

Tool used

Manual Review

Recommended Mitigation Steps

Slippage value should always be calculated or queried off chain, i.e the value should be passed in on the attempt to swap and then this value can then be checked agains t to see if it's equal to or less than requiredCollateralValue - collateralValueMinusSwapValue, this way the slippage is not hardcoded to 0 and can be set to whatever.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Slippage-issue

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Slippage-issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.