Skip to content
Request an audit

‹ All findings

_addLiquidity() slippage is incorrectly set

Crit/HighSingularity·Three Sigma · Private DeFi access · 26th February, 20243S-SG-H08

ReportSource

Description

The slippage is computed as:

solidity
mintAmount = _args.isLegacy & 12 == 12 ? IPools(_args.pool).calc_token_amount(curveInputAmounts) : IPools(_args.pool).calc_token_amount(curveInputAmounts, true);
mintAmount = (mintAmount / 100) * 95;

This gets the mintAmount value post price manipulation, rendering the slippage protection useless. Also, hardcoding a parameter of 95% slippage is not ideal. Here is a similar finding.

Recommendation

There are 2 solutions to this problem:

  1. Send the minimum mint amount as an argument.
  2. Use an offchain oracle such as Chainlink.

Status

Addressed in #8b300f0.