Submitted by Ruhum
https://github.com/code-423n4/2022-05-backd/blob/main/protocol/contracts/tokenomics/FeeBurner.sol#L43-L88
https://github.com/code-423n4/2022-05-backd/blob/main/protocol/contracts/swappers/SwapperRouter.sol#L414-L425
https://github.com/code-423n4/2022-05-backd/blob/main/protocol/contracts/swappers/SwapperRouter.sol#L439
While the SwapperRouter contract isnt explicitly in scope, its a dependency of the FeeBurner contract which is in scope. So I think its valid to make this submission.
The SwapperRouter contract uses the chainlink oracle to compute the minimum amount of tokens it should expect from the swap. The value is then used for the slippage check. But, if the chainlink oracle fails, for whatever reason, the contract uses 0 for the slippage check instead. Thus theres a scenario where swaps initiated by the FeeBurner contract can be sandwiched.
Either revert the transaction or initiate the transaction with a default slippage of 99%. In the case of Curve, you can get the expected amount through get_dy() and then multiply the value by 0.99. Use that as the min_out value and you dont have to worry about chainlink
chase-manning (Backd) disputed and commented:
Alex the Entreprenerd (judge) commented:
