Submission Details
Severity:
Insufficient Validation in Liquidity Provision
Description: In the liquidity_operations::provide_liquidity function, only the amount of token A is specified, and token B amount is calculated based on the current ratio. This can lead to unexpected slippage if the pool ratio changes between transaction submission and execution.
Impact: Users might provide more token B than expected, leading to financial losses.
Recommended Mitigation: Add a maximum token B parameter to the provide_liquidity function to protect users from unexpected price movements:
pub fn provide_liquidity(context: Context<ModifyLiquidity>,
amount_a: u64,
max_amount_b: u64
) -> Result<()> {
let amount_b = calculate_token_b_provision_with_a_given(
&mut context.accounts.vault_a,
&mut context.accounts.vault_b,
amount_a
)?;
require!(amount_b <= max_amount_b, AmmError::Slippage);
// Rest of the function
// ...
}
Updates
Lead Judging Commences
0xtimefliez
17 days ago
0xtimefliez 14 days ago
Submission Judgement Published Assigned finding tags:
Liquidity Provision Lacks Slippage Protection
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.