juancito - USSD::UniV3SwapInput() executes swaps with no slippage protection

[sherlock-admin]

juancito

high

USSD::UniV3SwapInput() executes swaps with no slippage protection

Summary

USSD::UniV3SwapInput() executes swaps with no slippage protection. That will cause a loss of funds because of sandwich attacks when rebalancing the protocol.

Vulnerability Detail

UUSD::UniV3SwapInput() does not set any value for amountOutMinimum. This means that an adversary can perform sandwich attacks against the protocol, as it accepts any amount of tokens.

UniV3SwapInput() is used by USSDRebalancer::rebalance(). So, the attack can be performed any time the swap is invoked.

    function UniV3SwapInput(
        bytes memory _path,
        uint256 _sellAmount
    ) public override onlyBalancer {
        IV3SwapRouter.ExactInputParams memory params = IV3SwapRouter
            .ExactInputParams({
                path: _path,
                recipient: address(this),
                //deadline: block.timestamp,
                amountIn: _sellAmount,
                amountOutMinimum: 0 // @audit
            });
        uniRouter.exactInput(params);
    }

Link to code

Impact

Loss of funds for the protocol because of sandwich attacks when trying to rebalance it.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L227-L240

Tool used

Manual Review

Recommendation

Define a proper amountOutMinimum value for executing the swaps.

Duplicate of #673