Skip to content
Request an audit

‹ All findings

PHyperLPoolSwapInside::_rebalance() checks the price manipulation before and after the swap with the same price threshold

Crit/HighClip Finance Strategy Upgrade·by the Three Sigma team·DeFi infrastructure·15th March 20243S-Clip-H02

Description

PHyperLPoolSwapInside::_rebalance() checks price manipulation before swapping to prevent sandwich attacks and after swapping as a way to mitigate slippage.

The same priceThreshold is used for both checks, which means that when rebalancing a large amount in comparison to the pool's liquidity, which would lead to significant slippage, an equally large priceThreshold would need to be used.

This means that the PHyperLPoolSwapInside would be vulnerable to sandwich attacks.

Recommendation

Use 2 different priceTreshold variables, the first one smaller to guarantee that no sandwich attacks will happen and a second one, which could be bigger, to check slippage.

Status

Addressed in #0c8de23.