Lack of Slippage Protection in RTokenP1 Contract

[c4-bot-9]

Lines of code

https://github.com/code-423n4/2024-07-reserve/blob/3f133997e186465f4904553b0f8e86ecb7bbacbf/contracts/p1/RToken.sol#L105

Vulnerability details

Vulnerability Details

The RTokenP1 contract implements crucial functions for issuing and redeeming RTokens. However, the current implementation lacks slippage protection, which could lead to users receiving significantly fewer tokens than expected due to price fluctuations or front-running attacks.

The following functions are vulnerable to slippage:

1. issueTo
2. redeemTo

These functions perform token exchanges or redemptions without allowing users to specify a minimum amount of tokens they expect to receive or a maximum amount they're willing to pay.

Code Snippets:

1. issueTo function:

   function issueTo(address recipient, uint256 amount) public notIssuancePausedOrFrozen {
   // ... (existing code)
   
   (address[] memory erc20s, uint256[] memory deposits) = basketHandler.quote(
       amtBaskets,
       true,
       CEIL
   );
   
   // No slippage protection here
   for (uint256 i = 0; i < erc20s.length; ++i) {
       IERC20Upgradeable(erc20s[i]).safeTransferFrom(
           issuer,
           address(backingManager),
           deposits[i]
       );
   }
   }

2. redeemTo function:

   function redeemTo(address recipient, uint256 amount) public notFrozen {
   // ... (existing code)
   
   (address[] memory erc20s, uint256[] memory amounts) = basketHandler.quote(
       baskets,
       false,
       FLOOR
   );
   
   // No slippage protection here
   for (uint256 i = 0; i < erc20s.length; ++i) {
       if (amounts[i] == 0) continue;
       IERC20Upgradeable(erc20s[i]).safeTransferFrom(
           address(backingManager),
           recipient,
           amounts[i]
       );
   }
   }

Impact

Without slippage protection, users are exposed to several risks:

1. Front-running attacks: Malicious actors could observe pending transactions and execute trades that manipulate the price, causing users to receive fewer tokens than expected.

2. Unexpected price movements: In volatile market conditions, the price of tokens might change significantly between the time a user initiates a transaction and when it's executed, resulting in unfavorable rates.

3. MEV (Miner Extractable Value) exploitation: Miners or validators could reorder transactions to their advantage, potentially at the expense of users.

4. Financial losses: Users might receive significantly fewer tokens than anticipated or pay more than they intended, leading to direct financial losses.

Fix

Implement slippage protection by adding parameters for minimum output amounts or maximum input amounts, and include checks to ensure these thresholds are met before executing the token transfers.

Assessed type

Invalid Validation