search

sherlock-audit / 2023-07-blueberry-judging

2 stars 1 forks source link

0xjoseph - High Risk of being frontrun when removing liquidity in CurveSpell #7

Closed sherlock-admin2 closed 1 year ago

sherlock-admin2 commented 1 year ago

0xjoseph

high

High Risk of being frontrun when removing liquidity in CurveSpell

Summary

Inside the _removeLiquidity function in the CurveSpell contract, if the isKilled variable is true the contract will call the Curve remove_liquidity function, passing in minOuts as an array of uint256 with default values of 0.

Vulnerability Detail

This leaves the function vulnerable to being front-run by a MEV bot where the MEV bot can potentially steal all user funds by manipulating the curve pools as the expected minOutAmount is 0.

Impact

Loss of all funds, that the LP is trying to withdraw.

Code Snippet

https://github.com/sherlock-audit/2023-07-blueberry/blob/main/blueberry-core/contracts/spell/CurveSpell.sol#L276-L289

Tool used

Manual Review

Recommendation

Estimate the minOutAmount off-chain when removing all liquidity and pass it in as an argument.

sherlock-admin2 commented 1 year ago

1 comment(s) were left on this issue during the judging contest.

shogoki commented:

This was a fix from the last audit. Should not be a problem