RewardReinvestor Is Vulnerable To Sandwich Attacks

Handle leastwood Vulnerability details Impact The splitReinvest function in RewardReinvestor is called upon by bonded users. An attacker can monitor the blockchain for calls to this function and launch a sandwich attack in combination with a flash loan to steal funds. A malicious user is...

IbbtcVaultZap.sol#deposit() can be front run

Handle WatchPug Vulnerability details function deposituint2564 calldata amounts public whenNotPaused // ... Given that IbbtcVaultZap.soldeposit will add liquidity to the curve pool, and the amount out differs when the price of tokens in the pool changes. However, the current implementation provid...

Improper implementation of slippage check

Handle WatchPug Vulnerability details function redeemIERC20 token, uint amount, uint poolId, int128 idx, uint minOut external defend blockLocked whenNotPaused returnsuint out ibbtc.safeTransferFrommsg.sender, addressthis, amount; Pool memory pool = poolspoolId; if poolId = minOut, "Slippage Check...

mint() Input Variable minOut Does Not Pass Value to interface ICurveFi add_liquidity()

Handle Meta0xNull Vulnerability details Impact Dev Note in Zap.sol: @param minOut Minimum amount of ibbtc to mint. Use for capping slippage while adding liquidity to curve pool. User Input minOut in function mint: function mintIERC20 token, uint amount, uint poolId, uint idx, uint minOut In...

Unused slippage params

Handle pauliax Vulnerability details Impact Unused slippage params. function addLiquidity in VaderRouter both V1 and V2 do not use slippage parameters: uint256, // amountAMin = unused uint256, // amountBMin = unused making it susceptible to sandwich attacks / MEV. For a more detailed explanation,...

VaderPoolV2.mintFungible exposes users to unlimited slippage

Handle TomFrench Vulnerability details Impact Frontrunners can extract up to 100% of the value provided by LPs to VaderPoolV2. Proof of Concept Users can provide liquidity to VaderPoolV2 through the mintFungible function. This allows users to provide tokens in any ratio and the pool will calculat...

mintSynth() and burnSynth() can be front run

Handle WatchPug Vulnerability details Given that mintSynth and burnSynth will issue and redeem assets based on the price of the pool reserves, and they will create price impact based on the volume being minted and burnt. However, the current implementation provides no parameter for slippage...

feePool is vulnerable to sandwich attack.

Handle jonah1005 Vulnerability details Impact There's a permissionless function distributeMochi in FeePoolV0. Since everyone can trigger this function, an attacker can launch a sandwich attack with flashloan to steal the funds. FeePoolV0.solL55-L62 The devs have mentioned this concern in the...

Controller does not raise an error when there's insufficient liquidity

Handle jonah1005 Vulnerability details Impact When a user tries to withdraw the token from the vault, the vault would withdraw the token from the controller if there's insufficient liquidity in the vault. However, the controller does not raise an error when there's insufficient liquidity in the...

Harvest can be frontrun

Handle 0xsanson Vulnerability details Impact In the NativeStrategyCurve3Crv.harvest there are two instances that a bad actor could use to frontrun the harvest. First, when we are swapping WETH to a stablecoin by calling swapTokensweth, stableCoin, remainingWeth, 1 the function isn't checking the...

wrong YAXIS estimates

Handle cmichel Vulnerability details The Harvester.getEstimates contract tries to estimate a YAXIS amount but uses the wrong path and/or amount. It currently uses a WETH input amount to compute a YAXIS - WETH trade. address memory path; path0 = IStrategystrategy.want; path1 =...

Vault: Withdrawals can be frontrun to cause users to burn tokens without receiving funds in return

Handle hickuphh3 Vulnerability details Impact Let us assume either of the following cases: 1. The vault / protocol is to be winded down or migrated, where either the protocol is halted and withdrawAll has been called on all active strategies to transfer funds into the vault. 2. There are 0...

No slippage protection in Strategy

Handle cmichel Vulnerability details The startPool and endPool functions of Strategy.sol mint/burn tokens in the pool without any minimum return amount checks: // startPool pool.mintaddressthis, true, 0 // endPool ,, uint256 fyTokenDivested = pool.burnaddressthis, 0, 0; If one of the pool tokens ...

Missing slippage checks

Handle cmichel Vulnerability details The Router and Pool does not implement any slippage checks with comparing the swap / liquidity results with a minimum swap / liquidity value. Impact Users can be frontrun and receive a worse price than expected when they initially submitted the transaction...

Repaying debt can be sandwich-attacked

Handle @cmichelio Vulnerability details Vulnerability Details When debt is repaid the Router.repayForMember function performs a swap to buy back debt: iPOOLSPOOLS.swapVADER, debtAsset, addressthis, true; A swap of large trade order size can be sandwich-attacked as it does not have any slippage...

Wrong slippage protection on Token -> Token trades

Handle @cmichelio Vulnerability details Vulnerability Details The Router.swapWithSynthsWithLimit allows trading token to token and specifying slippage protection. A token to token trade consists of two trades: 1. token to base 2. base to token The slippage protection of the second trade base to...

Default slippage value too high

Handle janbro Vulnerability details Summary Default slippage value too high. Risk Rating Medium Vulnerability Details MapleGlobals.sol Line 87: maxSwapSlippage = 1000; // 10 % The default slippage value of 10% is vulnerable to sandwich attackers which would shift larger costs onto stakers and LPs...