In the claimAndSwap
function, while there is a minimum output amount check ( _minOut
), it is only verified that this amount is greater than the input amount:
This check does not provide adequate protection against sandwich attacks or price manipulation, as it only ensures the output is higher than input, not that it meets a specific minimum threshold based on current market conditions. A malicious actor could manipulate the pool price just before the transaction to extract value.
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L99
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.