code-423n4 / 2022-04-backd-findings

6 stars 4 forks source link

QA Report #189

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Report

LiquidityPool slippage checks are unnecessary

When depositing to the liquidity pool or redeeming from it, the contract allows the user to provide a slippage check. But, the way the LP token shares work, there is no risk of being sandwiched or anything like that. Even if somebody frontruns your transaction to deposit a large amount of funds, you still get the same shares as you normally would.

Relevant code:

Use call() instead of transfer() when transferring ETH

transfer() only provides a set amount of gas for the transaction. It can cause issues for contracts that have some form of logic in their receive() function if gas costs of opcodes change in the future.

Relevant links:

Relevant code: