There is no slippage check for paraswap dex
Summary
In numerous places in the app, _doDexSwap() is being used to swap collateral to index or vice-versa.
In comparison to _doGmxSwap(), _doDexSwap() doesn't contain any parameter in regards to slippage check, so the possibility of a frontrunning attack or just a non-malicious large trade executing just before it, moving the price up and giving the user less tokens than expected.
Impact
Partial loss of funds due to the possibility of a sandwich attack or just a large non-malicious trade executing just before our paraswap trade.
Tools Used
Manual review
Recommendations
Create a slippage check such as minAmount when a trade happens
Lead Judging Commences
invalid_swap_slippage_and_deadline
Slippage and deadline are handled externally. Paraswap implementation used by the current code (behind the proxy): https://etherscan.io/address/0xdffd706ee98953d3d25a3b8440e34e3a2c9beb2c GMX code: https://github.com/gmx-io/gmx-synthetics/blob/caf3dd8b51ad9ad27b0a399f668e3016fd2c14df/contracts/order/OrderUtils.sol#L150C15-L150C33
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.