Open c4-bot-5 opened 7 months ago
Picodes marked the issue as primary issue
othernet-global (sponsor) acknowledged
Picodes marked the issue as satisfactory
Picodes changed the severity to QA (Quality Assurance)
I'll downgrade to Low as although this report is valid it doesn't discuss the fact that there is still an attempt to perform an arbitrage after each swap, which should in theory be sufficient to prevent the creation of a too large MEV opportunity. So the limitation is working as expected here.
Picodes marked the issue as grade-b
Lines of code
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/Upkeep.sol#L244
Vulnerability details
Impact
The
Liquidizer
contract has limited a max of 1% pool size for buying back USDS, which reduces impact on instant price drift, But theupkeep.performUpkeep()
function has no cool down, attackers can repeatedly call upkeep to spend all WBTC and WETH ofLiquidizer
contract in a same transaction. By doing this, a sandwich MEV attack to drain free fund from the protocol become available.Proof of Concept
The following coded PoC shows a realistic case that drains
0.145 WBTC
and1.46 WETH
from the protocol by this attack vector.And test logs:
Tools Used
Manually review
Recommended Mitigation Steps
Add a cool down for
upkeep.performUpkeep()
Assessed type
MEV