Skip to content
Request an audit

‹ All findings

Uniswap asset managers are missing slippage checks

MediumSingularity·Three Sigma · Private DeFi access · 26th February, 20243S-SG-M03

ReportSource

Description

All Uniswap interactions are missing a deadline argument and are not setting the following slippage protection arguments in UniswapLiquidityAssetManager:

  • amount0Min and amount1Min in MintParams.
  • amount0Min and amount1Min in DecreaseLiquidityParams. UniswapSwapAssetManager sets the minAmountOut value, but is not signed by the user in the circuit, so it could be gamed.

Recommendation

These arguments should be part of the proof and the user should sign them to prevent slippage.

Status

Addressed in #8b300f0.