Core Contracts

Summary

The _withdrawFromVault() function withdraws crvUSD from curveVault with a min_amount of 0, leaving users vulnerable to slippage or sandwich attacks in the Curve pool. This medium-impact, medium-likelihood issue could reduce withdrawal amounts in volatile conditions, eroding user returns and trust.

Vulnerability Details

The function calls curveVault.withdraw() without enforcing a minimum output. Example:

User withdraws 10,000 crvUSD.
Attacker frontruns, shifts pool price down 10%.
User receives 9,000 crvUSD; attacker backruns, profiting 1,000 crvUSD.
The lack of slippage protection exposes users to market manipulation during withdrawals.

Impact

Users may lose a portion of their funds (e.g., 1,000 crvUSD per attack), a medium-impact loss that could accumulate in volatile markets. The medium likelihood stems from Curve pool dynamics, where price swings are plausible, potentially discouraging vault usage.

Tools Used

Testing Frameworks: Foundry to simulate sandwich attacks on withdrawals.

Recommendations

Add a minAmount parameter to _withdrawFromVault():