qckhp - No slippage protection in USSD UniV3SwapInput function

[sherlock-admin]

qckhp

high

No slippage protection in USSD UniV3SwapInput function

Summary

There is no protection agains slippage in UUSD UniV3SwapInput input function which can lead to swandich attack and loss of funds

Vulnerability Detail

Attacker can trigger and swandich a rebalancing transaction

Impact

Attacker's ability to sandwitch attack a rebalance transaction as the amountOutMinimum parameter set to 0 when swapping in uniswap.

Code Snippet

function UniV3SwapInput(
        bytes memory _path,
        uint256 _sellAmount
    ) public override onlyBalancer {
        IV3SwapRouter.ExactInputParams memory params = IV3SwapRouter
            .ExactInputParams({
                path: _path,
                recipient: address(this),
                //deadline: block.timestamp,
                amountIn: _sellAmount,
                amountOutMinimum: 0
            });
        uniRouter.exactInput(params);
    }

https://github.com/USSDofficial/ussd-contracts/blob/f44c726371f3152634bcf0a3e630802e39dec49c/contracts/USSD.sol#L237

Tool used

Manual Review

Recommendation

Use the amountOutMinimum parameter instead of hardcoded 0 as value.

Duplicate of #673