Submission Details
Severity:
Hardcoded slippage exposes swap to unlimited slippage
Summary
Missing slippage exposes swap operations to MEV
Vulnerability Details
When swap Beans for the non-bean token of the SOP well, it provides the amountOutMin to be zero. which exposes the swap to unlimited MEV.
https://github.com/Cyfrin/2024-02-Beanstalk-1/blob/main/protocol/contracts/beanstalk/sun/SeasonFacet/Weather.sol#L207
// Approve and Swap Beans for the non-bean token of the SOP well.
C.bean().approve(sopWell, sopBeans);
uint256 amountOut = IWell(sopWell).swapFrom(
C.bean(),
sopToken,
sopBeans,
@> 0,
address(this),
type(uint256).max
);
Impact
Users can lose all amount swapped to MEV
Tools Used
Manual Review
Recommendations
Allow users to pass acceptable amountOut instead of zero
Updates
Lead Judging Commences
giovannidisiena about 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
SOP swap slippage
Prize pool breakdown
Total prize
100,000 USDC
nSLOC
5,77617 USDC / LOC
95,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.