function swapExactTokensForTokens(
uint amountIn,
uint amountOutMin,
address[] calldata path,
address to,
uint deadline
) external returns (uint[] memory amounts);
We can see that the amoutnOutMin slippage check parameter is missing, this makes the code vulnerable to frontrunning and sandwich attack, a sandwich bot can front-run the harvest function, buy before the IUniswapRouterV2(router).swapExactTokensForTokens trade to push the price up and after the trade sell and dump the token for profits at the loss of the reward token.
Tools Used
Manual Review
Recommended Mitigation Steps
We recommend the protocol implementatoin proper slippage check instead of set the amountOutMint to 0 when trade happens.
Lines of code
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/strategy/Pool2SingleAssetCompounder.sol#L62
Vulnerability details
Impact
Lack of slippage check when perform V2 Uniswap V2 trade in Pool2SingleAssetCompounder
Proof of Concept
In the current implementation of the code, the harvest function is called:
note the Uniswap V2 trade:
If we look into the API of the swapExactTokensForTokens in Uniswap V2,
https://docs.uniswap.org/contracts/v2/reference/smart-contracts/router-02#swapexacttokensfortokens
We can see that the amoutnOutMin slippage check parameter is missing, this makes the code vulnerable to frontrunning and sandwich attack, a sandwich bot can front-run the harvest function, buy before the IUniswapRouterV2(router).swapExactTokensForTokens trade to push the price up and after the trade sell and dump the token for profits at the loss of the reward token.
Tools Used
Manual Review
Recommended Mitigation Steps
We recommend the protocol implementatoin proper slippage check instead of set the amountOutMint to 0 when trade happens.