Submission Details
Severity:
[M-1] Slippage-Free Order Execution Enables Keeper Exploitation at PerpsEngine
Summary
The OrderBranch executes market orders without slippage parameters, allowing keepers to sandwich users.
Vulnerability Details
Affected Code:
// OrderBranch.sol (hypothetical)
function executeOrder(Order memory order) public {
uint256 received = dex.swap(order.amount);
user.transfer(received); // No minimum check
}
Exploit Scenario:
-
User submits order to buy 100 ETH at market price.
-
Keeper front-runs with large ETH buy, increasing price.
-
User receives 90 ETH instead of 100.
Impact
User Fund Loss: 10-30% per trade.
Medium Severity (CVSS 7.1).
Tools Used
Tenderly transaction simulation.
Historical price data analysis.
Recommendations
// Add slippage tolerance and deadline
function executeOrder(Order memory order, uint256 minOut, uint256 deadline) public {
require(block.timestamp <= deadline, "Expired");
uint256 received = dex.swap(order.amount);
require(received >= minOut, "Slippage exceeded");
}
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.