067.md

Cheery Rusty Marmot

Medium

Lack of Slippage Protection in Swap Operations Enabling Profitable Exploits for Malicious Actors

Summary

The AmirX contract lacks slippage protection in its swap functions, allowing for potential price manipulation. This vulnerability enables malicious actors to exploit large swap transactions, profiting at the user’s expense by taking advantage of price slippage and front-running opportunities. This can result in losses for regular users as the malicious user captures the difference caused by the lack of a slippage check.

Root Cause

https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/swap/AmirX.sol#L73-L172

The vulnerability is due to the absence of a slippage check (such as verifying a minimum output) and the failure to verify the difference in token balances before and after the transaction. This omission allows for situations where users receive a less favorable price during swaps, which a malicious actor could exploit to front-run and back-run these operations.

Internal pre-conditions

Absence of slippage validation: The contract performs swaps without verifying a minimum acceptable output amount.

External pre-conditions

• Mempool Monitoring for Pending Transactions: An external adversary can monitor the blockchain’s mempool to detect large incoming transactions.
• Availability of Front-running Opportunity: The blockchain’s processing speed and order of transaction inclusion can allow front-runners to insert transactions that capitalize on price changes initiated by users’ transactions.

Attack Path

• Monitor Large Swap Transactions: The malicious user continuously monitors the mempool for large pending swap transactions that lack slippage checks.
• Front-Run with Token Purchase: Upon detecting a significant swap transaction, the attacker executes a token purchase at the current lower price, which manipulates the price upwards.
• Victim’s Transaction Executes at a Worse Price: The victim's transaction executes at the manipulated, higher price, resulting in an unfavorable rate due to the lack of a minimum output check.
• Back-Run with Token Sale: The attacker quickly sells the token at the elevated price, profiting from the manipulated price and finalizing the exploit.

Impact

Users receive less than expected from their swaps, directly bearing the cost of price manipulation.

PoC

No response

Mitigation

Add a minimum output parameter for each swap to ensure users do not receive less than the intended amount due to price slippage.