Skip to content

Latest commit

 

History

History
51 lines (29 loc) · 1.81 KB

035.md

File metadata and controls

51 lines (29 loc) · 1.81 KB

Main Honeysuckle Tarantula

Medium

No slippage protection for sellVotes function

Summary

The protocol added slippage protection for the buyVotes function and now the user cannot buy less than he specified. However, the sellVotes function does not protect the user in this way. Therefore, the user can get much less eth from selling his votes than he should.

Let's consider two scenarios. The first is a normal market situation, when the user's buy order is executed at a different price than expected. The sell price falls if before that someone either sold the given vote or bought the opposite vote. During periods of strong market activity, users can lose money on slippage.

The second is the sandwich attack. Since it is Base L2 - its probability is low, but due to the discrete nature of price changes in the protocol - impact = high.

  1. A user places a transaction to sell TRUSTED votes.
  2. Malicious user realises that this transaction will lower the price of TRUSTED votes and does the following.

He sells all his TRUSTED votes before the user's transaction. He then skips the user transaction. He will already be selling at a lower price than expected. Then the malicious user buys back all his TRUSTED votes. Thus making money on the user's transaction, but harming the user.

Root Cause

No slippage protection for sellVotes

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

The user may receive less eth than expected due to market fluctuations.

It also opens up the possibility for very profitable sandwich attacks.

PoC

No response

Mitigation

Add minimal fundsReceived for every sell order