Canto Application Specific Dollars and Bonding Curves for 1155s - peritoflores's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/1155tech-contracts/src/Market.sol#L150 https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/1155tech-contracts/src/Market.sol#L174

Vulnerability details

Impact

​ Loss of funds

Analysis of the vulnerability

​ Functions buy() and sell() are swaps of NOTE for asD token.

​ Users call getBuyPrice and getSellprice just before buy and sellin order to estimate the price to pay / sell the token.

​ However, the nature of the blockchain causes this price to fluctuate if the transactions is frontrunned by other. As you receive the price from an external contract (Bonding Curve) that is be different for different coins the risk of losses for slippage is high.

​ As a result, you need to add a protection to these functions.

Recommendation

​ Similar to Uniswap, I suggest you adding a new parameter called maxAmountIn (or similar) to the buy function, that limits the amount of tokens the user is willing to transfer in exchange.

​ The transaction should revert if price + fee is higher than maxAmountIn

​ (uint256 price, uint256 fee) = getBuyPrice(_id, _amount);

​ [+] require(price + fee <= maxAmountInt, "Some message");

Similarly for sell function you can add a parameter called minAmountOut

Assessed type

Token-Transfer