Submitted by cmichel
The Harvester.getEstimates contract tries to estimate a YAXIS amount but uses the wrong path and/or amount.
It currently uses a WETH input amount to compute a YAXIS -> WETH trade.
The estimations from getEstimates are wrong.
They seem to be used to provide min. amount slippage values (_estimatedWETH, _estimatedYAXIS) for the harvester when calling Controller._estimatedYAXIS.
These are then used in BaseStrategy._payHarvestFees and can revert the harvest transactions if the wrongly computed _estimatedYAXIS value is above the actual trade value.
Or they can allow a large slippage if the _estimatedYAXIS value is below the actual trade value, which can then be used for a sandwich attack.
Fix the estimations computations.
As the estimations are used in BaseStrategy._payHarvestFees, the expected behavior seems to be trading WETH to YAXIS.
The path should therefore be changed to path[0] = WETH; path[1] = YAXIS in Harvester.getEstimates.
Haz077 (yAxis) acknowledged
GalloDaSballo (judge) commented:
