Paraswap swaps in _doDexSwap lack explicit min-out constraints, allowing large slippage or potential MEV manipulation.

Summary

• _doDexSwap sends tokens to Paraswap using externally generated call data but does not enforce a minimum output on-chain.

• Price could move unfavorably or front-runners could exploit the trade.

Vulnerability Details

• The function calls ParaSwapUtils.swap(...) with no additional on-chain check like require(outputAmount >= minExpected).

• If the Paraswap aggregator call is front-run or manipulated, the vault might receive fewer tokens.

ImpactSignificant user losses in extreme volatility or malicious front-running.

• Unbounded slippage scenario where user deposit or vault funds get poor pricing.

Tools Used

• Manual code inspection.

• Common DeFi best practices for DEX aggregator usage.

Recommendations

• Add a minOutputAmount parameter in _doDexSwap or parse it from the ParaSwap call data, then assert on-chain with require.

• Alternatively, incorporate a slippage tolerance check in the vault logic itself.