Submission Details
Severity:
missing slippage on curve vault withdrawal
contracts sets max_loss to zero, which allows withdrawal from curveVault exposed to high slippage.
function _withdrawFromVault(uint256 amount) internal {
curveVault.withdraw(amount, address(this), msg.sender, 0, new address[](0));<@
Impact
withdraws from vaults are exposed to unlimited slippage
Recommendation
Add acceptable max_loss on vault withdrawal
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.