Closed code423n4 closed 2 years ago
Interest bearing vaults cant be frontrun or sandwiched. You deposit/withdraw exact amounts in these cases
Interest bearing vaults cant be frontrun or sandwiched. You deposit/withdraw exact amounts in these cases
Technically, they can be easily frontran via a priority gas auction taking place on L1. That said, as you intuitively understand, it is generally a moot point with over-collateralized lending vault tokens as returns are continuous rather than discrete.
This one is very similar to the comment I made here (https://github.com/code-423n4/2022-07-swivel-findings/issues/167#issuecomment-1200490937) and is QA at best. Grouping with the warden's main QA report at #165
Lines of code
https://github.com/code-423n4/2022-07-swivel/blob/daf72892d8a8d6eaa43b9e7d1924ccb0e612ee3c/Swivel/Swivel.sol#L739-L759
Vulnerability details
Impact
Withdraw doesn't check for the minimum amount of underlying token withdrawn. If some protocol can be attacked by MEV sandwiching bot, user may loss fund to MEV bot on withdrawing.
Proof of Concept
Withdraw just check whether withdrawing is success or not. But not checking the final underlying token balance after withdraw to see if it is sandwiched or not.
Tools Used
Manual review
Recommended Mitigation Stepp
Add minimum underlying token received after withdraw to the function input. And check the different in underlying token balance at the end.