Submitted by cmichel
The contracts are missing slippage checks which can lead to being vulnerable to sandwich attacks.
See StrategyCvxHelper.harvest:
Trades can happen at a bad price and lead to receiving fewer tokens than at a fair market price. The attackers profit is the protocols loss.
Add minimum return amount checks.
Accept a function parameter that can be chosen by the transaction sender, then check that the actually received amount is above this parameter.
Alternatively, check if its feasible to send these transactions directly to a miner such that they are not visible in the public mempool.
GalloDaSballo (BadgerDAO) acknowledged:
ghoul-sol (judge) commented:
