Liquidity Management

Summary

The withdrawal process lacks slippage protection, which can cause users to receive significantly less than expected due to price fluctuations or on-chain execution delays. This is particularly problematic for users withdrawing large amounts or when market conditions change between transaction submission and execution.

Additionally, the governance fee is only applied if the withdrawal amount exceeds the original deposit. However, if slippage causes the final received amount to drop below expectations, the user may unintentionally pay a governance fee on a lower-than-expected withdrawal, leading to an unfair deduction.

Vulnerability Details

• A user submits a withdrawal request expecting to receive exactly 5,000 collateral tokens, expects to withdraw 5,500 tokens (a 500-token profits).

• Before execution, the market shifts, reduces their real withdrawal amount to 5,200 tokens.

• The system still assumes a 500-token profit instead of the actual 200-token profit

• Governance fee is overcharged based on a non-existence profit.

• The user receive less then expected after fees are deducted from the incorrect profit amount.

Impact

• Users may receive less than anticipated during withdrawal due to price fluctuation, leading to potential financial loss.

• Governance fee miscalculation if profit appears higher due to slippage unexpected slippage.

• Users unknowingly overpay fees due to slippage reducing their real profit.

• Exploitable via front-running: A malicious actor can manipulate market conditions (e.g., large sell orders) before a user's withdrawal executes, causing slippage that results in the user paying a higher governance fee than necessary.

Tools Used

Manual Review

Recommendations

Compute profit based on the actual received amount after slippage, rather than exepcted amounts.
Allow users to specify a minimum expected amount (slippage tolerance) before executing the withdrawal.
Verify final withdrawn amount before applying governance fees, ensuring that users do not overpay.