Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Slippage Protection when converting assets to Usdc

ifexx445

Summary

The _convertAssetsToUsdc function in CreditDelegationBranch.sol (lines 727-752) handles the conversion of various assets to USDC using a specified DEX swap strategy. However, the function does not incorporate slippage protection mechanisms during swaps. As a result, the conversion process might yield significantly lower USDC outputs than expected, particularly in volatile market conditions or scenarios with high price impact.

Vulnerability Details

function _convertAssetsToUsdc(
uint128 dexSwapStrategyId,
address asset,
uint256 assetAmount,
bytes memory path,
address recipient,
address usdc
)
internal
returns (uint256 usdcOut)
{
// revert if the amount is zero
if (assetAmount == 0) revert Errors.AssetAmountIsZero(asset);
​
// if the asset being handled is usdc, simply output it to `usdcOut`
if (asset == usdc) {
usdcOut = assetAmount;
} else {
// approve the asset to be spent by the dex adapter contract
DexSwapStrategy.Data storage dexSwapStrategy = DexSwapStrategy.loadExisting(dexSwapStrategyId);
IERC20(asset).approve(dexSwapStrategy.dexAdapter, assetAmount);
​
// verify if the swap should be input single or multihop
if (path.length == 0) {
// prepare the data for executing the swap
SwapExactInputSinglePayload memory swapCallData = SwapExactInputSinglePayload({
tokenIn: asset,
tokenOut: usdc,
amountIn: assetAmount,
recipient: recipient
});
​
// swap the credit deposit assets for USDC and store the output amount
usdcOut = dexSwapStrategy.executeSwapExactInputSingle(swapCallData);
} else {
// prepare the data for executing the swap
@> SwapExactInputPayload memory swapCallData = SwapExactInputPayload({
path: path,
tokenIn: asset,
tokenOut: usdc,
amountIn: assetAmount,
recipient: recipient
});
​
// swap the credit deposit assets for USDC and store the output amount
@> usdcOut = dexSwapStrategy.executeSwapExactInput(swapCallData);
}
​

As we can see in the pointer precision can be lost when converting assets.

Impact

Users may receive far less USDC than anticipated due to unfavorable price movements or insufficient liquidity on the DEX.

Tools Used

Manual Audit

Recommendations

Introduce minAmountOut

if (usdcOut < minimumOutput) {
revert Errors.SlippageExceeded();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.