Part 2

Summary

Calculating the amountOutMinimum of swaps onchain allows MEV sandwitch attack on the swap, amountOutMinimum should be supplied as input to the function. Calculating the amountOutMinimum can be handled on the frontend.

Vulnerability Details

The swap logic of the following function calculates the amountOutMinimum onchain.

1. CurveAdapter.sol#executeSwapExactInputSingle(....)

2. CurveAdapter.sol#executeSwapExactInput(...)

3. UniswapV2Adapter.sol#executeSwapExactInputSingle(...)

4. UniswapV2Adapter.sol#executeSwapExactInput(...)

5. UniswapV3Adapter.sol#executeSwapExactInputSingle(...)

6. UniswapV3Adapter.sol#executeSwapExactInput(...)

Calculating amountOutMinimum onchain is worthless because:

1. The MEV attacker bots will have adjusted the price of the pool by frontrunning

2. After the price adjustment, then calculation of amountOutMinimum is done when executing the swap

3. Attacker back runs the swap to sell back to the pool to make profit

So the amountOutMinimum will be calculated from the state of an already manipulated pool before in the swap transaction. That is why it is better to calculate the amountOutMinimum offchain then passed to the swap function. Calculation of `amountOutMinimum can be handled on the frontend just like it is done on swap dapps like Uniswap.

• https://github.com/Cyfrin/2025-01-zaros-part-2/blob/main/src/utils/dex-adapters/CurveAdapter.sol#L87C7-L96C41

• https://github.com/Cyfrin/2025-01-zaros-part-2/blob/main/src/utils/dex-adapters/CurveAdapter.sol#L125C13-L135C45

• https://github.com/Cyfrin/2025-01-zaros-part-2/blob/main/src/utils/dex-adapters/UniswapV2Adapter.sol#L86C9-L98C44

• https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/utils/dex-adapters/UniswapV2Adapter.sol#L117C9-L128C44

• https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/utils/dex-adapters/UniswapV3Adapter.sol#L91C9-L108C48

• https://github.com/Cyfrin/2025-01-zaros-part-2/blob/35deb3e92b2a32cd304bf61d27e6071ef36e446d/src/utils/dex-adapters/UniswapV3Adapter.sol#L126C9-L138C51

Impact

Sandwich attack by MEV bots to adjust the price in a frontrunning attack and sell back to the pool after the swap there by making profit from the adjusted price. The swap buys the loss from adjusted price.

Tools Used

Manual Review

Recommendations

Consider passing amountOutMinimum as input to the swap function. This amountOutMinimum can calculated on the frontend before sending the transaction.