Skip to content
Request an audit

‹ All findings

Distribute is permissionless, allowing malicious users to specify 0 slippage and sandwich the swap

Crit/HighTrestle wTIA Bridge·by the Three Sigma team·Modular blockchain infrastructure·27th January 20243S-TR-H01

Report PageSource

Description

distribute() uses the argument amountOutMinimum as slippage control, but the function is permissionless, so malicious users can trigger swaps with 0 minimum amount out.

Recommendation

Set up a keeper role to distribute rewards.

Status

Addressed by disabling taxes.

Found during Three Sigma’s team review · 0xSimao on the review team