Nyx - No slippage control

[sherlock-admin]

Nyx

high

No slippage control

Summary

When swapping amountOutMinimum is set to 0. There is no slippage protection, protocol can lose funds.

Vulnerability Detail

function UniV3SwapInput(
        bytes memory _path,
        uint256 _sellAmount
    ) public override onlyBalancer {
        IV3SwapRouter.ExactInputParams memory params = IV3SwapRouter
            .ExactInputParams({
                path: _path,
                recipient: address(this),
                //deadline: block.timestamp,
                amountIn: _sellAmount,
                amountOutMinimum: 0
            });
        uniRouter.exactInput(params);
    }

When the protocol needs to rebalance pool, the protocol buys collateral or sells. And it uses UniV3SwapInput() function for it.

IUSSD(USSD).UniV3SwapInput(collateral[i].pathsell, amountToSellUnits);

But there is no slippage control in UniV3SwapInput() function. If Unexpected swaps occur, the protocol can suffer a huge loss due to no slippage protection.

Impact

Unexpected swaps can occur, and the protocol can suffer a huge loss due to no slippage protection.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L227-L240

Tool used

Manual Review

Recommendation

amountOutMinimum: 0

add slippage control to UniV3SwapInput() function.

Duplicate of #673