Summary

The StrategyArb contract contains an incorrect slippage validation implementation within the _swapUnderlyingToAsset function. The current slippage validation relies solely on the minOut parameter passed by the caller. This approach allows an attacker to set an unreasonably low minOut value, enabling swaps at unfavorable prices and potentially causing significant losses for the protocol.

Vulnerability Details

Caller-Defined minOut: The minOut parameter, which determines the minimum acceptable output tokens, is supplied by the caller and lacks verification against price oracles.

• No Price Oracle Integration: There is no mechanism to validate the swap rate (e.g., using a price oracle) to ensure that the swap occurs at a fair price.

Exploitation Scenario

1. A malicious keeper calls the claimAndSwap function with a deliberately low minOut value.

2. The _swapUnderlyingToAsset function approves the transaction as long as the minOut is marginally greater than _amount, bypassing slippage protection.

3. The attacker routes the swap through unfavorable paths, causing a significant loss in the value of tokens received compared to the underlying tokens sent.

Tools Used

Mqnual Review

Recommendations

Price Oracle Validation
Use a reliable price oracle (e.g., Chainlink) to fetch the current market price of underlying and asset. Compare the swap rate with the oracle price and ensure it does not exceed a predefined slippage tolerance. Example: