Liquidity Management

Summary

The current swap implementation lacks explicit slippage protection, exposing the protocol to potential economic inefficiencies even when executed by a trusted keeper.

Vulnerability Details

• Intended Swap: 100 USDC → WETH

• Expected Output: 0.05 WETH

• Actual Received: 0.025 WETH

• Loss: 50% of expected swap value

Impact

• Keeper executes swap at an economically unfavorable moment

• No mechanism to prevent extremely poor swap rates

Absence of minimum output validation

Tools Used

AGI

Recommendations

function _doDexSwap(
bytes memory data,
bool isCollateralToIndex,
uint256 minExpectedOutput // <---
) internal returns (uint256 outputAmount) {
// Existing swap logic

}