The TSwapPool::swapExactOutput
function does not include any sort of slippage protection. This function is similar to what is done in TSwapPool::swapExactInput
, where the function specifies a minOutputAmount
, the swapExactOutput
function should specify a maxInputAmount
to limit the amount of tokens the user is willing to pay.
This vulnerability makes the user succeptible to MEV (sandwich attacks and frontrunning attacks).
Any user on the Ethereum network has the ability to watch for new transactions being sent to the network. When the attacker sees a large victim transaction that they want to front run come in, they can create a similar transaction that would move the market up. They then increase their gas fees to ensure that their order gets executed first. The attacker transaction executes, raising the price of the asset, and then the victim transaction executes at the higher price. The attacker is then free to exit the position immediately, pocketing the difference, having never exposed themselves to any risk.
Sophisicated front-runners will likely call these transactions from their own contract addresses to make sure they end up with the prices they expect, and don't collide with other front-runners.
For example:
The price of 1 WETH right now is 1000 USDC
User inputs a swapExactOutput
looking for 1 WETH
inputToken = USDC
outputToken = WETH
outputAmount = 1
deadline = whatever
The function does not offer a maxInput Amount
As the transaction is pending in the mempool, the market changes! And the price moves HUGE -> 1 WETH is now 10000 USDC. 10x more than the user expected.
The transaction completes, but the user sent the protocol 10000 USDC instead of the expected 1000 USDC.
Add this test to TSwapPool.t.sol
:
Foundry test suite and manual review
Include a maxInputAmount
so the user only has to spend up to a specific amount, and can predict how much they will spend on the protocol.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.