# `ManagedLeveragedVault::donateCollateral()` is missing a slippage check Low/Info · Sherlock · CDP stablecoin · 25th April, 2025 Finding L-6 of the Beraborrow Managed Dens security review. - Protocol: https://www.beraborrow.com/ - Report: /reports/beraborrow-i - Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85 --- ## Summary `ManagedLeveragedVault::donateCollateral()` doesn't control slippage, leading to losses ## Vulnerability Detail The function is: ```solidity function donateCollateral(uint256 _collateralAmount, address _upperHint, address _lowerHint) external onlyOwner { BoycoVaultStorage storage b$ = _getBoycoVaultStorage(); uint256 assetsNeeded = b$.collVault.previewMint(_collateralAmount); IERC20(asset()).transferFrom(msg.sender, address(this), assetsNeeded); IERC20(asset()).forceApprove(address(b$.collVault), assetsNeeded); b$.collVault.mint(_collateralAmount, address(this)); IERC20(address(b$.collVault)).forceApprove(address(b$.borrowerOperations), _collateralAmount); _addColl(_collateralAmount, _upperHint, _lowerHint); // TODO consider invariants } ``` As can be seen, there is no slippage check in the coll vault, possibly leading to fund loss. It may be mitigated by the approval amount. ## Impact Collateral vaults are not really manipulatable but still it may be possible for the price to change too much. ## Code Snippet https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR492 ## Tool Used Manual Review ## Recommendation Add a slippage check. --- Related findings: - [Uniswap asset managers are missing slippage checks](https://0xsimao.com/findings/singularity-uniswap-managers-slippage-checks): Singularity - [Duplicated slippage check in SyrupUserActions](https://0xsimao.com/findings/maple-finance-syrup-duplicated-slippage-check): Maple Syrup - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO - [OstiumTrading::topUpCollateral() is missing pairsStored.groupMaxCollateral(pairIndex) check](https://0xsimao.com/findings/ostium-collateral-pairs-stored-index): Ostium