Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Sandwich Attack Risk in Keeper's Transaction Due to Missing Slippage Protection

rampage

Summary

The PerpetualVault.sol contract's _doDexSwap() function lacks slippage protection mechanisms, making keeper-initiated swaps vulnerable to sandwich attacks.

Vulnerability Details

In the PerpetualVault.sol contract, the _doDexSwap() function executes token swaps through Paraswap without implementing any slippage tolerance checks. The function is triggered when keepers invoke run() (for leverage) or runNextAction().

The critical issue lies in the swap execution logic:

/**
* @dev Executes a DEX swap using Paraswap.
* @param data Swap transaction data.
* @param isCollateralToIndex Direction of swap. If true, swap `collateralToken` to `indexToken`.
* @return outputAmount The amount of output tokens received from the swap.
*/
function _doDexSwap(bytes memory data, bool isCollateralToIndex) internal returns (uint256 outputAmount) {
(address to, uint256 amount, bytes memory callData) = abi.decode(data, (address, uint256, bytes));
IERC20 inputToken;
IERC20 outputToken;
if (isCollateralToIndex) {
inputToken = collateralToken;
outputToken = IERC20(indexToken);
} else {
inputToken = IERC20(indexToken);
outputToken = collateralToken;
}
uint256 balBefore = outputToken.balanceOf(address(this));
ParaSwapUtils.swap(to, callData);
outputAmount = IERC20(outputToken).balanceOf(address(this)) - balBefore;
emit DexSwap(address(inputToken), amount, address(outputToken), outputAmount, isCollateralToIndex);
}

Without slippage protection, malicious actors can observe keeper transactions in the mempool and execute sandwich attacks by manipulating the token prices before and after the swap.

Impact

High severity. Attackers can extract value from the protocol through sandwich attacks on keeper-initiated swaps, leading to direct financial losses.

Tools Used

Manual Review, Code Analysis

Recommendations

  1. Implement slippage protection in the _doDexSwap() function by adding a minimum output amount check

  2. Consider using a price oracle to validate swap rates

  3. Add a configurable slippage tolerance parameter that can be adjusted based on market conditions

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_swap_slippage_and_deadline

Slippage and deadline are handled externally. Paraswap implementation used by the current code (behind the proxy): https://etherscan.io/address/0xdffd706ee98953d3d25a3b8440e34e3a2c9beb2c GMX code: https://github.com/gmx-io/gmx-synthetics/blob/caf3dd8b51ad9ad27b0a399f668e3016fd2c14df/contracts/order/OrderUtils.sol#L150C15-L150C33

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!