After pool is initialized, user can perform a sandwich attack through front-running and back-running mint transaction by calling swap function twice to manipulate initial price to be much different than market price and gain much more of output token than expected

Lines of code Vulnerability details Impact After the following initialize function is called, the pool does not own any of the tokens at that moment since the mint function below is not called yet. When the mint transaction is sent, a malicious user can notice it in the mempool and front-run it b...

Stable/non-stable pair creation mistake could be abused

Lines of code Vulnerability details Impact Stable and non-stable pair use different formula to calculate the invariant k. If a non-stable pair is treated as stable, or vice versa. $x^3y+y^3x$ behave quite differently compare with $xy$, on the edge of relative stable price range, price volatility...

Yield of LiquidityReserve can be stolen

Lines of code Vulnerability details Impact Using sandwich attacks and JIT Just-in-time liquidity, the yield of LiquidityReserve could be extracted for liquidity providers. Proof of Concept The yield of LiquidityReserve is distributed when a user calls instantUnstakeReserve in Staking. Then, in...

[PNM-002] Unfairness: the curator (or users with large shares) can always reject payout by sandwich attacks

Lines of code Vulnerability details Impact 15% Attack Description The initiateBuyout function uses the current valuation instead of the time-weighted average one to determine buyoutRejectionValuation, making the curator or any other early buyers with a relatively large sharing able to reject...

in reimburseLiquidityFees() of SponserVault contract swaps tokens without slippage limit so its possible to perform sandwich attack and it create MEV

Lines of code Vulnerability details Impact when code swaps tokens it should specify slippage but in reimburseLiquidityFees code contract calls tokenExchange.swapExactIn without slippage and it's possible to perform sandwich attack and make contract to swap on bad exchange rates and there is MEV...

Harvest is vulnerable to sandwich attack.

Lines of code Vulnerability details Impact Function harvest does multiple swaps from auraBAL - BAL/ETH BPT - WETH - AURA using BalancerVault. But it doesn’t use minAmountsOut or have a check for mimimum return amount. It makes this function vulnerable to sandwich attack. An attacker which can be ...

Users will lose all of their money during pool migration

Lines of code Vulnerability details Impact Users will lose all of their money when they migrate by calling PoolMigrationZap.migrate Proof of Concept File: protocol/contracts/zaps/PoolMigrationZap.sol 1 52 function migrateaddress oldPoolAddress public override 53 ILiquidityPool oldPool =...

Sandwich attack on astroport sweep

Lines of code Vulnerability details Impact The collector contract allows anyone to sweep, swapping an asset token to ANC through astro port. Note that beliefprice is not set and config.maxspread might not be set as well or misconfigured. This allows an attacker to create a contract to perform a...

ThecosomataETH.addLiquidity can be subject to sandwich attack

Lines of code Vulnerability details Impact Liquidity addition can happen at a manipulated pool state and result in receiving fewer LP shares than actual market state dictates Proof of Concept addLiquidity measures slippage based on the pool returned amount via calctokenamount: Pool returned amoun...

Possible Sandwich attack on mintFromNOTE, mintFromETH & mintFromWETH in sNOTE.sol

Handle UncleGrandpa925 Vulnerability details Issue There are 3 ways for users to mint sNOTE: mintFromNOTE, mintFromWETH & mintFromETH, and all 3 of them use the mintFromAssets function. Looking at the mintFromAssets, it basically just forces add all the liquidity in the Balancer pool without any...

No slippage protection on _swapUstToUnderlying can lead to lost funds

Handle harleythedog Vulnerability details Impact The function swapUstToUnderlying exists to swap Ust to underlying tokens. The last argument to exchangeunderlying is mindy, which specifies the minimum number of underlying to be returned from the swap. Currently, this value is set to 0, so the...

No slippage protection on _swapUnderlyingToUst can lead to lost funds

Handle harleythedog Vulnerability details Impact The function swapUnderlyingToUst exists to swap underlying tokens to Ust. The last argument to exchangeunderlying is mindy, which specifies the minimum number of Ust to be returned from the swap. Currently, this value is set to 0, so the function i...

No slippage control on _swapUnderlyingToUst of NonUSTStrategy.sol

Handle cccz Vulnerability details Impact There is no slippage control on swapUnderlyingToUst of NonUSTStrategy.sol, which expose strategy to sandwich attack. Due to the access control of doHardWork, the attacker can front run to do a sandwich attack. function doHardWork external...

No slippage control on _swapUstToUnderlying of NonUSTStrategy.sol

Handle cccz Vulnerability details Impact There is no slippage control on swapUstToUnderlying of NonUSTStrategy.sol, which expose strategy to sandwich attack. And since finishRedeemStable lacks access control, anyone can do a sandwich attack by calling the swapUstToUnderlying function. function...

Possible price manipulation while adding liquidity to uniV3

Handle 0x421f Vulnerability details Right now if we see the code there are no checks before liq being added to check if pool is manipulated. Hence there rises possibility of sandwich attack vector here, more so with concentrated liq imo Could be done with flash loan or with own tokens Attack woul...

stabilize() is vulnerable to flashloan sandwich attack

Handle WatchPug Vulnerability details When the price of Malt is off the lowerThreshold and upperThreshold, StabilizerNode.sol will market buy/sell Malt. However, since the market sell can be triggered by anyone, and there is no slippage control, it makes it vulnerable to flashloan sandwich attack...

Missing slippage/min-return check in UniswapHandler

Handle cmichel Vulnerability details The contracts are missing slippage checks which can lead to being vulnerable to sandwich attacks. A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets...

No slippage control on deposit of IbbtcVaultZap.sol

Handle gzeon Vulnerability details Impact There is no slippage control on deposit of IbbtcVaultZap.sol, which expose user to sandwich attack. Proof of Concept Any deposit can be sandwiched, especially when the pool is not balanced. Tools Used Recommended Mitigation Steps Add a minOut in line with...

No slippage protection in VaderPoolV2.mintSynth

Handle cmichel Vulnerability details The VaderPoolV2.mintSynth implicitly performs a "native - foreign" swap using VaderMath.calculateSwapnativeDeposit,reserveNative,reserveForeign, the resulting amount will be minted as synths instead of transferred out as foreign tokens. The calculateSwap...

add liquidity is vulnerable to sandwich attack

Handle jonah1005 Vulnerability details add liquidity is vulnerable to MEV Impact addLiquidity in the VaderRouter and VaderRouterV2 contract does not check the minimum liquidity amount. This makes users' funds vulnerable to sandwich attacks. The team says a minimum amount is not required as the...