HardhatDeFi
15,000 USDC
View results
Submission Details
Severity: medium
Invalid

Lack of Slippage Protection in Liquidity Operations

Issue Description:
The AaveDIVAWrapper contracts do not implement any form of slippage protection when adding or removing liquidity, particularly in functions like _addLiquidity and _removeLiquidity. Slippage refers to the difference between the expected price of a trade and the price at which the trade is executed. Without slippage protection, users might receive less collateral or tokens than expected due to price movements or high fees:

In _addLiquidity, tokens are supplied to Aave, and wTokens are minted to interact with DIVA, but there's no mechanism to ensure that the amount of wTokens minted reflects the current market conditions or fees:

function _addLiquidity(
bytes32 _poolId,
uint256 _collateralAmount,
address _longRecipient,
address _shortRecipient
) internal {
// ...
_handleTokenOperations(_collateralToken, _collateralAmount, _pool.collateralToken);
// ...
IDIVA(_diva).addLiquidity(_poolId, _collateralAmount, _longRecipient, _shortRecipient);
}

Similarly, _removeLiquidity does not check if the amount of collateral returned after redeeming wTokens matches what was expected:

function _removeLiquidity(
bytes32 _poolId,
uint256 _positionTokenAmount,
address _recipient
) internal returns (uint256) {
// ...
uint256 _amountReturned = _redeemWTokenPrivate(
_pool.collateralToken, // wToken
_wTokenAmountReturned,
_recipient,
address(this)
);
return _amountReturned;
}

Impact:
The primary impact is potential financial loss for users due to unexpected slippage where users might receive less value than they anticipated when adding or removing liquidity, especially in volatile market conditions or when fees are high.

Mitigation:
Implement slippage checks by allowing users to specify a minimum amount of tokens they expect to receive or a maximum amount of collateral they are willing to supply for an operation.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.