search

code-423n4 / 2022-10-thegraph-findings

0 stars 0 forks source link

Unused slippage params #94

Closed code423n4 closed 1 year ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/l2/gateway/L2GraphTokenGateway.sol#L141-L142

Vulnerability details

Impact

Unused slippage params. function outboundTransfer in L2GraphTokenGateway (both L1 and L2) do not use slippage parameters., making it susceptible to sandwich attacks / MEV.

Proof of Concept

https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/l2/gateway/L2GraphTokenGateway.sol#L141-L142

    'uint256, // unused on L2
    uint256, // unused on L2'

Tools Used

Recommended Mitigation Steps

Consider paying some attention to the slippage to reduce possible manipulation attacks from mempool snipers.

0xean commented 1 year ago

closing as invalid. Rates are meant to be 1:1 here.