Olas - windowhan001's results

Lines of code

https://github.com/code-423n4/2023-12-autonolas/blob/2a095eb1f8359be349d23af67089795fb0be4ed1/lockbox-solana/solidity/liquidity_lockbox.sol#L277

Vulnerability details

Impact

Users can suffer losses due to MEV when withdrawing liquidity.

Proof of Concept

On Solana, a validator chosen by the Leader Rotation Mechanism can arbitrarily order transactions. This mechanism can lead to significant user losses if the minimum output for each token is not checked when burning LP Tokens and withdrawing liquidity.

function withdraw(uint64 amount) external {
     ...
     whirlpool.decreaseLiquidity{accounts: metasDecreaseLiquidity, seeds: [[pdaProgramSeed, pdaBump]]}(amount, 0, 0);
    ...
}

Tools Used

Manual Audit

Recommended Mitigation Steps

Referring to the Orca whirlpool code (https://github.com/orca-so/whirlpools/blob/fc7dac3037c208fd1806ec80b8a43fbcc6648bdc/programs/whirlpool/src/lib.rs#L251-L256), it is advisable to set the second and third arguments of decrease_liquidity to something other than zero. These should be parameters additionally received through the withdraw function.

Assessed type

MEV