No slippage and / or deadline protection in depositAsset()

Lines of code Vulnerability details Proof of Concept The function depositAsset allows a user to deposit a specific amount of any supported token and, in return, receive a specific amount of rsETH. This amount of rsETH is calculated by dividing the total value of deposited assets in ETH by the pri...

Lack of slippage in redeem can result in loss of shares for redeemer

Lines of code Vulnerability details FPS holders can redeem their shares against zchf using redeem File: Equity.sol 276: function redeemaddress target, uint256 shares public returns uint256 //@audit no slippage, calculateProceeds can return 0 277: requirecanRedeemmsg.sender; 278: uint256 proceeds ...

No slippage control on _swapUnderlyingToUst of NonUSTStrategy.sol

Handle cccz Vulnerability details Impact There is no slippage control on swapUnderlyingToUst of NonUSTStrategy.sol, which expose strategy to sandwich attack. Due to the access control of doHardWork, the attacker can front run to do a sandwich attack. function doHardWork external...