Closed c4-bot-9 closed 6 months ago
0xRobocop marked the issue as sufficient quality report
0xRobocop marked the issue as primary issue
Omnipool provides slippage protection via PriceBarrier::ensure_price
. Leaving for sponsor review.
enthusiastmartin (sponsor) confirmed
enthusiastmartin marked the issue as disagree with severity
Valid medium because there is a hypothetical path to leak values and in-line with other contests were missing slippage checks were medium.
OpenCoreCH marked issue #93 as primary and marked this issue as a duplicate of 93
OpenCoreCH marked the issue as satisfactory
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L577 https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/stableswap/src/lib.rs#L995 https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/stableswap/src/lib.rs#L1118
Vulnerability details
Impact
Some of the functions in
omnipool
andstableswap
lack slippage protection, and users may not expect the same results when they add liquidity.For example :
omnipool#add_liquidity
,hub_asset_liquidity
is variable, The share amount available to the user is calculated usingcalculate_add_liquidity_state_changes
, which relies onhub_asset_liquidity
, so the user may receive less share amount than expected.Proof of Concept
omnipool and stableswap's user-facing function,buy sell, have slippage protection added, for example: omnipool's
buy
function can setmax_sell_amount
.slippage protection is also added to
add_liquidity_shares
in thestablepool
, andmax_asset_amount
can be set:The problem is that there are other functions that add liquidity that don't have slippage protection:
stableswap#do_add_liquidity
do_add_liquidity
functions similarly todo_add_liquidity_shares
, adding liquidity tostablepool
,do_add_liquidity
can add liquidity to multiple assets, However,do_add_liquidity
does not setSlippageLimit
asdo_add_liquidity_shares
does.omnipool#add_liquidity in
omnipool#add_liquidity
,hub_asset_liquidity
is variable, The share amount available to the user is calculated usingcalculate_add_liquidity_state_changes
, which relies onhub_asset_liquidity
, so the user may receive less share amount than expected.Tools Used
vscode, manual
Recommended Mitigation Steps
Add slippage protection to all necessary functions
Assessed type
MEV