sam_gmk - No slippage protection

[sherlock-admin]

sam_gmk

high

No slippage protection

Summary

Vulnerability Detail

  function UniV3SwapInput(
        bytes memory _path,
        uint256 _sellAmount
    ) public override onlyBalancer {
        IV3SwapRouter.ExactInputParams memory params = IV3SwapRouter
            .ExactInputParams({
                path: _path,
                recipient: address(this),
                //deadline: block.timestamp,
                amountIn: _sellAmount,
                amountOutMinimum: 0
            });
        uniRouter.exactInput(params);
    }

The amountOutMinimum is slippage protection to ensure a certain amount is received incase there is a price change between transaction call and execution. Since the amountOutMinimum is specified to be 0, this means the contract is willing to accept a 0 output for a given input.

Impact

Due to lack of slippage protection, all swaps are open to sandwich attacks and will lead to loss of funds.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L237

Tool used

Manual Review

Recommendation

Duplicate of #673