Part 2

Summary

The FeeDistributionBranch::_performMultiDexSwap function, responsible for executing multi-hop swaps across different assets using specified DEX strategies, is vulnerable to frontrunning and slippage exploits. The function does not include slippage protection, allowing an attacker to manipulate on-chain prices by placing large trades before the swap executes, causing unfavorable rates for the protocol. Additionally, since it uses approve instead of safeApprove, there is a potential risk of improper allowance handling, leading to further security concerns. These vulnerabilities can result in financial losses for users by executing swaps at worse-than-expected rates.

Vulnerability Details

Impact

The impact of the lack of slippage protection in the _performMultiDexSwap function, when called by the convertAccumulatedFeesToWeth function, is that the protocol may receive less WETH than expected when converting accumulated fees. This happens due to potential price fluctuations and liquidity issues across the DEXes involved in the swap. As a result, the protocol could suffer from unexpected losses, making it harder to meet financial obligations or maintain accurate balances. Additionally, the protocol becomes vulnerable to manipulation, where malicious actors could exploit the lack of slippage control to reduce the amount of WETH received during swaps.

Tools Used

Recommendations