Liquidity Management

Summary

Keeper transactions are vulnerable to MEV bots front/back-running due to lack of order uniqueness protections.

Vulnerability Details

The PerpetualVault contract allows keepers to execute orders without unique identifiers, making it possible for attackers to detect pending transactions in the mempool and front-run them with identical orders. This results in the attacker's order being executed first, causing the legitimate order to execute at a worse price, leading to potential economic losses for the protocol and its users.

Root Cause:
The root cause of this issue is the lack of order uniqueness protections and slippage control in the PerpetualVault contract. The contract does not use unique identifiers for transactions, allowing attackers to duplicate and front-run orders.

Proof of Concept:

Copy and paste in PerpetualVault.t.sol and run

Impact

• Economic Losses: The protocol and its users may suffer economic losses due to front-running attacks.

• Price Impact Exploitation: Front-run orders amplify price movement for back-run profit.

• Lack of Slippage Control: No per-order max slippage checks allow unlimited price impact.

Tools Used

Manual

Recommendations

1. Commit-Reveal Scheme:
   Implement a commit-reveal scheme to ensure order uniqueness and prevent front-running.

   // KeeperProxy.sol

   mapping(address => bytes32) public commitments;

   ​

   function commitRun(bytes32 commitment) external onlyKeeper {

   commitments[msg.sender] = commitment;

   }

   ​

   function revealRun(

   bytes32 nonce,

   bytes calldata params,

   bytes calldata signature

   ) external onlyKeeper {

   require(commitments[msg.sender] == keccak256(abi.encode(nonce, params, signature)));

   // Execute logic

   }

2. MEV-Resistant Order Types:
   Implement MEV-resistant order types with unique identifiers and slippage control.

   // PerpetualVault.sol

   function run(

   uint256 maxPriceImpact,

   bytes32 salt // Unique per order

   ) external {

   require(!usedSalts[salt], "Duplicate order");

   usedSalts[salt] = true;

   // Revert if price impact exceeds allowed

   require(priceImpact <= maxPriceImpact);

   }