exchange_underlying in functions _swapUnderlyingToUst and _swapUstToUnderlying lack slippage control, it uses a default value of 0 minimum received.
A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets the victim execute the trade, and then backruns (executes after) the victim by trading back the amount gained in the first trade. Intuitively, one uses the knowledge that someone’s going to buy an asset, and that this trade will increase its price, to make a profit. The attacker’s plan is to buy this asset cheap, let the victim buy at an increased price, and then sell the received amount again at a higher price afterwards.
Recommended Mitigation Steps
Consider making this slippage parameter configurable, so you can set it if it will be exploited by the mempool beasts.
naps62
commented
2 years ago
Handle
pauliax
Vulnerability details
Impact
exchange_underlying in functions _swapUnderlyingToUst and _swapUstToUnderlying lack slippage control, it uses a default value of 0 minimum received.
A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets the victim execute the trade, and then backruns (executes after) the victim by trading back the amount gained in the first trade. Intuitively, one uses the knowledge that someone’s going to buy an asset, and that this trade will increase its price, to make a profit. The attacker’s plan is to buy this asset cheap, let the victim buy at an increased price, and then sell the received amount again at a higher price afterwards.
Recommended Mitigation Steps
Consider making this slippage parameter configurable, so you can set it if it will be exploited by the mempool beasts.