# _addLiquidity() slippage is incorrectly set Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-H08 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description The slippage is computed as: ```solidity mintAmount = _args.isLegacy & 12 == 12 ? IPools(_args.pool).calc_token_amount(curveInputAmounts) : IPools(_args.pool).calc_token_amount(curveInputAmounts, true); mintAmount = (mintAmount / 100) * 95; ``` This gets the mintAmount value post price manipulation, rendering the slippage protection useless. Also, hardcoding a parameter of 95% slippage is not ideal. [Here](https://solodit.xyz/issues/m-05-wrong-slippage-check-code4rena-redacted-cartel-redacted-cartel-contest-git) is a similar finding. ### Recommendation There are 2 solutions to this problem: 1. Send the minimum mint amount as an argument. 2. Use an offchain oracle such as Chainlink. ### Status Addressed in [#8b300f0](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/8b300f07a28f2c073154c8de3e9e90ba64ef1934). --- Related findings: - [Type 1 borrower liquidation will incorrectly add cds profit directly to `totalCdsDepositedAmount`](https://0xsimao.com/findings/autonomint-type-liquidation-directly-deposited): Autonomint - [`LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-slippage): Teller Finance - [Add a 0 address check on the pool when adding liquidity for greater verbosity](https://0xsimao.com/findings/nftperp-ii-add-adding-greater-verbosity): Nftperp Matching Engine - [ShadowStrategyGauge::addVestingPosition() may revert if there is 0 liquidity to add](https://0xsimao.com/findings/yieldoor-i-shadow-gauge-vesting-revert): Yieldoor Gauges