sherlock-audit / 2023-10-looksrare-judging

6 stars 6 forks source link

BoRonGod - `sqrtPriceLimitX96` and `deadline` are not defined in InfiltrationPeriphery.sol #141

Closed sherlock-admin2 closed 1 year ago

sherlock-admin2 commented 1 year ago

BoRonGod

false

sqrtPriceLimitX96 and deadline are not defined in InfiltrationPeriphery.sol

Vulnerability Detail

In heal function, User's ETH is swapped to fixed quantity of $LOOKS. However, Use a sqrtPriceLimitX96 value of 0 means any slippage can be accepted.

Impact

If the user provides too much ETH, MEV robots will receive the portion exceeding the current price. If the user provides too little ETH, the transaction is likely to fail due to $LOOKS price fluctuations.

Code Snippet

Tool used

Manual Review

Recommendation

sqrtPriceLimitX96 should be decided by user