Submitted by Agontuk, also found by Bauchibred, minglei-wang-3570, and crypticdefense
The AuraVault contract implements ERC-4626 vault functionality, allowing users to deposit assets and mint shares. However, the deposit and mint functions lack slippage controls, which can result in users receiving fewer shares or sending more assets than expected. This issue is similar to a previously reported bug in the bHermes contract, where the absence of slippage controls in the ERC4626DepositOnly.deposit and ERC4626DepositOnly.mint functions led to unexpected outcomes for users.
The AuraVault contract is designed to manage assets and distribute rewards from an Aura RewardsPool. It includes functions for depositing assets and minting shares, which are critical for users interacting with the vault. However, these functions do not allow users to specify slippage parameters, exposing them to potential financial losses.
deposit Function
The deposit function allows users to deposit a specified amount of assets and receive shares in return. The function calculates the number of shares to be minted using the previewDeposit function and then proceeds with the deposit. However, it does not allow users to specify a minimum number of shares to be minted, which can lead to slippage issues.
mint Function
The mint function allows users to mint a specified number of shares by depositing the required amount of assets. The function calculates the required assets using the previewMint function and then proceeds with the minting. However, it does not allow users to specify a maximum number of assets to be sent, which can lead to slippage issues.
The root cause of the issue is the absence of slippage control parameters in the deposit and mint functions. Users cannot specify minimum shares to be minted or maximum assets to be sent, leading to potential financial losses due to slippage.
Users can lose funds due to unexpected slippage when interacting with the AuraVault contract. Specifically, they may receive fewer shares than expected when depositing assets or send more assets than expected when minting shares. This can result in significant financial losses, especially in volatile market conditions.
Similarly, for the mint function:
Add slippage control parameters to the deposit and mint functions to allow users to specify minimum shares to be minted and maximum assets to be sent. This will ensure that transactions revert if the slippage conditions are not met.
These changes allow users to specify their slippage tolerance, protecting them from unexpected losses due to market volatility or delayed transaction execution.
amarcu (LoopFi) acknowledged and commented:
Koolex (judge) commented:
Note: For full discussion, see here.
