Platform: Code4rena
Start Date: 06/01/2022
Pot Size: $60,000 USDC
Total HM: 20
Participants: 33
Period: 7 days
Judge: LSDan
Total Solo HM: 9
Id: 67
League: ETH
Rank: 28/33
Findings: 1
Award: $90.06
🌟 Selected for report: 0
🚀 Solo Findings: 0
pmerkleplant
The functions _swapUnderlyingToUst and _swapUstToUnderlying in
NonUSTStrategy.sol are vulnerable to sandwich attacks.
Sandwich attacks leak value from the protocol.
The above mentioned functions initiate trades on Curve using Curve's
exchange_underlying function (see line 78 and 94).
However, the function expects an argument of minimum amounts of tokens to
receive. This amount is set to 0, opening the doors for sandwich attacks.
Always calculate an estimate return when trading on Curve.
#0 - naps62
2022-01-11T18:41:51Z
duplicate of #8
#1 - dmvt
2022-01-27T11:48:51Z
duplicate of #7