Skip to content
Request an audit

‹ Findings database

Codeup::claimCodeupERC20() is vulnerable to sandwich attacks

Low/InfoCODEUP audit·Three Sigma·DeFi game·23rd October, 2024L-2

Description

Codeup::claimCodeupERC20() does not set minimum values for adding liquidity or swapping (sets 0) and places a deadline of block.timestamp, which means mev bots may sandwich these calls for profit for the protocol's loss.

Recommendation

Send the minimum amounts as argument as well as the deadline.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests