Submitted by rvierdiiev, also found by zhuXKET, R2, cccz, sces60107 and ladboy233.
RubiconMarket checks slippage incorrectly, user can loose funds because of that.
RubiconMarket.sellAllAmount function has price protection. User should provide min_fill_amount param to that function in order to limit minimum amount they would like to receive.
https://github.com/code-423n4/2023-04-rubicon/blob/main/contracts/RubiconMarket.sol#L1028-L1067
When order is filling in this function, the full offer amount is added to fill_amt param.
fill_amt is the filled amount without fees. Fees will be decreased in the end of function.
But slippage is checked before fees are removed.
This is incorrect, as user will provide min_fill_amount that they want to receive after all fees.
The same problem exists for RubiconMarket.buyAllAmount.
VsCode
First calculate amount without fees, then check slippage:
bghughes (Rubicon) confirmed and commented:
