BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Missing slippage protection on deposit function.

0xarinaitwe

Missing slippage protection on deposit function.

Description

The deposit function in the briVault contract allows users to deposit ERC20 tokens, then mints shares to the users. The rate at which shares are minted can change rapidly. Normally, there should be a minimum amount of shares a user is willing to receive when they deposit a certain amount of tokens to protect them from volatile conversion rate changes.

The deposit function lacks this slippage protection in case of volatile conversion rate changes, any conversion rate change can change the token ratio users expected and cause possible losses for users.

// @audit: missing slippage protection
function deposit(uint256 assets, address receiver) public override returns (uint256) {
require(receiver != address(0));
​
if (block.timestamp >= eventStartDate) {
revert eventStarted();
}
​
uint256 fee = _getParticipationFee(assets);
​
if (minimumAmount + fee > assets) {
revert lowFeeAndAmount();
}
​
uint256 stakeAsset = assets - fee;
​
stakedAsset[receiver] = stakeAsset;
​
uint256 participantShares = _convertToShares(stakeAsset);
​
IERC20(asset()).safeTransferFrom(msg.sender, participationFeeAddress, fee);
​
IERC20(asset()).safeTransferFrom(msg.sender, address(this), stakeAsset);
​
_mint(msg.sender, participantShares);
​
emit deposited(receiver, stakeAsset);
​
return participantShares;
}

Risk

Likelihood:

  • Coversion rate frequently changes between signing and execution.

Impact:

  • Users can receive less shares than expected.

Recommended Mitigation

Implement slippage protection where a user inputs a minimum amount of shares they can receive.

function deposit(uint256 assets, address receiver, uint256 minAmount) public override returns (uint256) {
...
​
require(participantShares >= minAmount, "Slippage protection");
​
...
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!