The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Vulnerability to MEV Attacks in SmartVaultV3's Swap Function

0xCiphky

Vulnerability Details:

The swap function within the SmartVaultV3 contract lacks protective measures against MEV attacks due to its current implementation. Specifically, the following areas:

  • Deadline: The function sets the deadline parameter in the ExactInputSingleParams to block.timestamp. This configuration permits the execution of transactions at any future point, potentially allowing malicious actors to delay transactions until market conditions turn unfavourable.

  • amountOutMinimum: The amountOutMinimum is derived from the calculateMinimumAmountOut function, which can return zero under certain conditions. Setting amountOutMinimum to zero makes the swap vulnerable to front-running, where attackers can manipulate the transaction.

  • sqrtPriceLimitX96: The parameter sqrtPriceLimitX96 is hardcoded to zero, further exposing the swap to potential front-running attacks.

function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
uint256 swapFee =
_amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: _amount - swapFee,
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth()
? executeNativeSwapAndFee(params, swapFee)
: executeERC20SwapAndFee(params, swapFee);
}

Tools Used:

Manual analysis

Recommendation:

Allow users to specify their own values for deadline, amountOutMinimum, and sqrtPriceLimitX96 so they can set more suitable constraints for their transactions

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Slippage-issue

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Slippage-issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.