Submission Details
Severity:
No slippage protection when withdrawing tokens
Summary
In function SablierFlow:_withdraw, due to absence of minimumOutputAmount , a sudden price change (or other adjustments) may result in a smaller output than expected, potentially leading to user losses.
Vulnerability Details
Here is the Vulnerability details,
function _withdraw(
uint256 streamId,
address to,
uint128 amount
)
internal
returns (uint128 withdrawnAmount, uint128 protocolFeeAmount)
{
Impact
Users might get low outputAmount when withrawing due to fluctuation in the price of the tokens.
Tools Used
Manual Review
Recommendations
the parameter minimumOutputAmountshould be added and set preventing users form getting low output than expected offering slippage protection, to the _withdrawfunction in SablierFlowsmart contract like this:
function _withdraw(
uint256 streamId,
address to,
uint128 amount,
+uint128 minOutput
+// Add minOutput parameter
) internal returns (uint128 withdrawnAmount, uint128 protocolFeeAmount)
{
+require(amount >= minOutput, "Slippage protection: output less than minimum");
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.