sherlock-audit / 2023-01-derby-judging

4 stars 1 forks source link

immeas - `Swap::swapStableCoins` assumes 1:1 price #407

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

immeas

medium

Swap::swapStableCoins assumes 1:1 price

Summary

Swap::swapStableCoins assumes 1:1 price

Vulnerability Detail

amountOutMin for the stablecoin swap is calculated like this: https://github.com/sherlock-audit/2023-01-derby/blob/main/derby-yield-optimiser/contracts/libraries/Swap.sol#L42-L43

This essentially says that the value during a deposit must be >1:1 or <1:1 during a withdrawal. This is a bit risky since stable coins can move against eachother.

This might cause deposits and withdrawals in protocols with other underlying stable coins to fail, in turn causing rebalance to fail.

Impact

A deposit or withdraw might not be possible if price has moved against the vault just a little. This can cause rebalance to fail and have to wait until the price has moved up/down a little.

Code Snippet

https://github.com/sherlock-audit/2023-01-derby/blob/main/derby-yield-optimiser/contracts/libraries/Swap.sol#L42-L43

Tool used

Manual Review

Recommendation

Allow a buffer for the stablecoins to move within, like within 99%

Duplicate of #135