T1MOH - No slippage control when performing swap in USSD.sol

[sherlock-admin]

T1MOH

high

No slippage control when performing swap in USSD.sol

Summary

Protocol doesn't set slippage when performs swap in UniswapV3Pool. That opens opportunity for sandwich attacks on protocol, which results in loss of funds

Vulnerability Detail

Sets amountOutMinimum = 0 when perform swap

    function UniV3SwapInput(
        bytes memory _path,
        uint256 _sellAmount
    ) public override onlyBalancer {
        IV3SwapRouter.ExactInputParams memory params = IV3SwapRouter
            .ExactInputParams({
                path: _path,
                recipient: address(this),
                //deadline: block.timestamp,
                amountIn: _sellAmount,
                amountOutMinimum: 0
            });
        uniRouter.exactInput(params);
    }

Attack scenario is very basic:

1. Protocol wants to sell WBTC for DAI
2. MEV frontruns tx and buy DAI. Therefore WBTC costs nothing comparing to DAI
3. Protocol sells WBTC, getting near 0 amount of DAI
4. MEV sells bought DAI, cheaply buying protocol's WBTC

Protocol lose money

Impact

Rebalancer performs disadvantageous trades during rebalancing, which results in loss of funds.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L227-L240

Tool used

Manual Review

Recommendation

Set slippage when perform swap

Duplicate of #673