Lack of slippage protection cause loss of funds for user.
SwapExactOutput
function lacks of slippage protection.
As we can see, that to handle amounts it has only outputAmount
which is not sufficient. It should have one more input maxInputAmount
which will save users from being rekt. (getting few tokens than expected).
Price of 1 WETH is say 4000 USDC.
User execute the tx with to get 1 weth as output. So he input
inputToken = USDC
outputToken = WETH
outputAmount = 1
deadline = current time + 360
The given function don't allow to put limit of maxInput that protocol can deduct to execute the swap. (No slippage protection)
As tx goes to mempool in pending state, MEV or say due to high market volatility, Weth reaches new hights and now 1 WETH = 16000 USDC. it's 4x more than the user input.
Transaction is confirmed now, but user spent 4x than he thought.
In highly volatile markets, or even MEV's can exploit this to make user getting worst swap.
Manual Review
Add a maxInputAmount
input and if statement that will control the slippage. Which is essential to save user funds and revert the tx if trade is not favorable.
Given below:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.