Olas - thank_you's results

Lines of code

https://github.com/code-423n4/2023-12-autonolas/blob/main/lockbox-solana/solidity/liquidity_lockbox.sol?plain=1#L277

Vulnerability details

Impact

When a user wants to withdraw their tokens form the LiquidityLockbox, users will call the withdraw() function. In turn, when withdraw() is called, the LiquidityLockbox calls Whirlpool's decreaseLiquidity function to decrease the liquidity in a given position. When this function is called, LP tokens are burned in exchange for asset tokens. The Orca function supports passing in slippage checks, i.e. tokenMinA and tokenMinB. Unfortunately, the LiquidityLockbox passes in 0 values for both arguments:

whirlpool.decreaseLiquidity{accounts: metasDecreaseLiquidity, seeds: [[pdaProgramSeed, pdaBump]]}(amount, 0, 0);

This can lead to the user withdrawing far less tokens than expected if a sudden market shift occurs.

Proof of Concept

Imagine a scenario where a user wants to withdraw a large portion of tokens. The user calls LiquidityLockbox#withdraw. The following scenario occurs:

1. Market shift occurs and LP/tokens exchange rate drops.
2. User does not know this sudden change occurs and calls LiquidityLockbox#withdraw.
   • Because the slippage values are set to zero, there is no guarantee what tokens the user will receive.
3. Tx from step 2 is complete and user is left with less tokens than expected.

Users withdrawing liquidity will not be able to control how much at minimum they would like to receive.

Tools used

Manual Review

Recommended Mitigation Steps

Allow users to pass in two additional arguments in the withdraw() function to allow them to manually set the slippage values:

function withdraw(uint64 amount, uint64 minTokenA, uint64 minTokenB) external {
    .....
    // Audit: adding in the minTokenA and minTokenB values will ensure we have proper slippage checks in place. 
    whirlpool.decreaseLiquidity{accounts: metasDecreaseLiquidity, seeds: [[pdaProgramSeed, pdaBump]]}(amount, minTokenA, minTokenB);

Sources

• Orca Documentation

• Orca Whirlpool Contract API

Assessed type

Timing