innertia - Sandwich attack could result in substantial losses

[sherlock-admin]

innertia

high

Sandwich attack could result in substantial losses

Summary

The minimum amount of tokens to be received is not set when swapping tokens.
Therefore, an attacker can launch a sandwich attack on a swap transaction to unfairly reduce the amount of tokens received by the project.
This is a substantial loss of funds.

Vulnerability Detail

In the UniV3SwapInput(bytes memory _path, uint256 _sellAmount) function, amountOutMinimum is hard-coded to 0. Therefore, the token received could be zero.
A sandwich attack could result in a significant loss of project assets.

Impact

Substantial loss of property value

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/6d7a9fdfb1f1ed838632c25b6e1b01748d0bafda/ussd-contracts/contracts/USSD.sol#L237

Tool used

Manual Review

Recommendation

Set the appropriate value for amountOutMinimum, depending on the situation.

Duplicate of #673