# PHyperLPoolSwapInside::_rebalance() checks the price manipulation before and after the swap with the same price threshold Crit/High · Three Sigma · DeFi infrastructure · 15th March 2024 Finding 3S-Clip-H02 of the Clip Finance Strategy Upgrade security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-strategy-upgrade - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-03-15-clip-finance-ii.pdf --- ### Description [PHyperLPoolSwapInside::_rebalance()](https://github.com/ClipFinance/StrategyRouter-private/pull/107/files#diff-023946f07f510e865612a28a9a222e00f0f6b90a253fd981e9bf4f7656f5497fR481) checks price manipulation before swapping to prevent sandwich attacks and after swapping as a way to mitigate slippage. The same priceThreshold is used for both checks, which means that when rebalancing a large amount in comparison to the pool's liquidity, which would lead to significant slippage, an equally large priceThreshold would need to be used. This means that the PHyperLPoolSwapInside would be vulnerable to sandwich attacks. ### Recommendation Use 2 different priceTreshold variables, the first one smaller to guarantee that no sandwich attacks will happen and a second one, which could be bigger, to check slippage. ### Status Addressed in [#0c8de23](https://github.com/ClipFinance/StrategyRouter-private/commit/0c8de23862d9fed65f3c1a3fc4eac9a0356ef76e#diff-023946f07f510e865612a28a9a222e00f0f6b90a253fd981e9bf4f7656f5497fR508-R512). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [_handleSwapAction(...) creates situations where the arguments receiver and sweeper need to be the same address in BaseRouter](https://0xsimao.com/findings/fuji-finance-handle-creates-situations-sweeper): Fuji Finance - [rebalance(), withdrawAmount needed from the ReservePool can be simplified](https://0xsimao.com/findings/glacier-rebalance-withdraw-needed-simplified): Glacier - [`IDOPoolAbstract::withdrawSpareIDO()` does not take into account that several rounds may use the same `IdoToken`](https://0xsimao.com/findings/blast-ido-pools-withdraw-spare-several-rounds): Blast IDO Pools - [Potential overflow in PancakeSwapPlugin:getRoutePrice()](https://0xsimao.com/findings/clip-finance-i-overflow-pancake-plugin-price): Clip Finance Strategies