# `Codeup::claimCodeupERC20()` is vulnerable to sandwich attacks Low/Info · Three Sigma · DeFi game · 23rd October, 2024 Finding L-2 of the CODEUP security review. - Report: /reports/codeup - Source: https://cdn.sanity.io/files/qoqld077/staging/d9e57830a75b5165fd56e8b88037de7986a165ec.pdf --- ### Description `Codeup::claimCodeupERC20()` does not set minimum values for adding liquidity or swapping (sets 0) and places a deadline of `block.timestamp`, which means mev bots may sandwich these calls for profit for the protocol's loss. ### Recommendation Send the minimum amounts as argument as well as the deadline. --- Related findings: - [`LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-slippage): Teller Finance