search

code-423n4 / 2022-01-sandclock-findings

0 stars 0 forks source link

[WP-M4] `NonUSTStrategy.sol` Lack of slippage control #160

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2022-01-sandclock/blob/a90ad3824955327597be00bb0bd183a9c228a4fb/sandclock/contracts/strategy/NonUSTStrategy.sol#L74-L85

function _swapUnderlyingToUst() internal {
    uint256 underlyingBalance = _getUnderlyingBalance();
    if (underlyingBalance > 0) {
        // slither-disable-next-line unused-return
        curvePool.exchange_underlying(
            underlyingI,
            ustI,
            underlyingBalance,
            0
        );
    }
}

The current implementation of doHardWork() and finishRedeemStable() -> _swapUnderlyingToUst() and _swapUstToUnderlying() provides no parameter for slippage control, making it vulnerable to front-run attacks.

Recommendation

Consider adding a amountOutMin parameter.

naps62 commented 2 years ago

duplicate of #7