Submission Details
Severity:
[M-2] Missing Slippage Accumulation in Batch Swaps Enables Partial Drain at `StabilityBranch`
Summary
The StabilityBranch::initiateSwap function processes multiple swaps in a batch without cumulative slippage checks, enabling MEV on individual swaps.
Vulnerability Details
Affected Code:
// StabilityBranch.sol
for (uint256 i; i < amountsIn.length; i++) {
// Processes each swap independently
}
Exploit Scenario:
-
User submits 10 swaps of 100 USD each with 5% slippage.
-
Keeper front-runs each swap, extracting 1% per trade.
-
Total 10% profit from the batch.
Impact
User Fund Loss: Up to slippage tolerance per swap.
Severity: Medium (CVSS 6.9).
Tools Used
Manual review
Foundry
Recommendations
// Add batch slippage check
uint256 totalMinOut = sum(minAmountsOut);
require(totalReceived >= totalMinOut, "Batch slippage");
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.