In veCVXStrategy, the cvxCRV -> ETH -> CVX conversion via sushiswap is done with 0 minAmountOut, making it susceptible to sandwich attacks / MEV flashbots. This is also true for UniSwapper inherited by StrategyCvxHelper.
Recommended Mitigation Steps
veCVXStrategy
Ideally, the harvest() function should take in a minAmountOut parameter, but this breaks the Yearn architecture used. Using TWAPs / price oracles might alleviate the problem, but results in higher gas usage, and with multiple hops involved, may not be feasible.
A simpler approach would be to have a configurable storage variable minAmountOut. Its value can then be adjusted such that harvesting can be done infrequently to save gas.
UniSwapper
Ideally, each path registered in the TokenSwapPathRegistry should also have a minAmount mapping, that can be fetched together with the path.
Handle
hickuphh3
Vulnerability details
Impact
In
veCVXStrategy
, thecvxCRV -> ETH -> CVX
conversion via sushiswap is done with 0 minAmountOut, making it susceptible to sandwich attacks / MEV flashbots. This is also true forUniSwapper
inherited byStrategyCvxHelper
.Recommended Mitigation Steps
veCVXStrategy
Ideally, the
harvest()
function should take in aminAmountOut
parameter, but this breaks the Yearn architecture used. Using TWAPs / price oracles might alleviate the problem, but results in higher gas usage, and with multiple hops involved, may not be feasible.A simpler approach would be to have a configurable storage variable
minAmountOut
. Its value can then be adjusted such that harvesting can be done infrequently to save gas.UniSwapper
Ideally, each path registered in the
TokenSwapPathRegistry
should also have aminAmount
mapping, that can be fetched together with the path.