Submitted by Chom, also found by Jeiwan
AlgebraPool.sol#L416-L485
AlgebraPool.sol#L589-L623
AlgebraPool.sol#L626-L673
Missing slippage control system. Users may lose a lot of funds due to front-running MEV bots. It has liquidityDesired or amountRequired but these parameters are only used in output amount calculation. It isnt used to prevent the output amounts from dropping below a threshold. So, MEV bots can front-run to profit from dropping the output amount of user swap.
See wardens original report for full PoC and Recommended Mitigation Steps.
0xean (judge) commented:
vladyan18 (QuickSwap & StellaSwap) acknowledged and commented:
0xean (judge) commented:
sameepsi (QuickSwap & StellaSwap) disagreed with severity and commented:
0xean (judge) commented:
0xean (judge) decreased severity to Medium and commented:
For this audit, 72 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by 0xNazgul received the top score from the judge.
The following wardens also submitted reports: CodingNameKiki, IllIllI, Deivitto, 0xSmartContract, Rolezn, brgltd, RockingMiles, Bnke0x0, Aymen0909, rbserver, delfin454000, RaymondFam, defsec, aysha, __141345__, mics, oyc_109, trustindistrust, cccz, fatherOfBlocks, sikorico, slowmoses, chrisdior4, Shinchan, V_B, kaden, reassor, 0x52, 0x1f8b, JC, martin, Tomo, Jeiwan, Chom, Mukund, a12jmx, bulej93, gogo, ladboy233, rotcivegaf, ajtra, lukris02, sorrynotsorry, cryptonue, erictee, catchup, 0xDecorativePineapple, Matin, Ruhum, 0xmatt, Aeros, asutorufos, cryptphi, d3e4, DimitarDimitrov, Ocean_Sky, p_crypt0, pedr02b2, Satyam_Sharma, tnevler, Waze, durianSausage, karanctf, Lambda, mahdikarimi, rvierdiiev, natzuu, carrotsmuggler, Migue, Olivierdem, and Trabajo_de_mates.
