# Distribute is permissionless, allowing malicious users to specify 0 slippage and sandwich the swap Crit/High · Three Sigma · Modular blockchain infrastructure · 27th January 2024 Finding 3S-TR-H01 of the Trestle wTIA Bridge security review. - Report: /reports/trestle-wtia-bridge - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-01-27-trestle.pdf --- ### Description distribute() uses the argument [amountOutMinimum](https://github.com/TrestleProtocol/Audit-Contracts/blob/main/src/Trestle.sol#L300) as slippage control, but the function is permissionless, so malicious users can trigger swaps with 0 minimum amount out. ### Recommendation Set up a keeper role to distribute rewards. ### Status Addressed by disabling taxes. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after](https://0xsimao.com/findings/fuji-finance-deposits-specify-withdraw-shares): Fuji Finance - [_crossTransfer(...) should revert if users specify routerByDomain[destDomain] as destination](https://0xsimao.com/findings/fuji-finance-transfer-revert-specify-dest): Fuji Finance - [Malicious path can be passed to redeem/withdraw() allowing an attacker to draing the strategy](https://0xsimao.com/findings/more-markets-path-redeem-withdraw-draing): MORE Optimizer - [OffchainExchange::swapAmm() does not validate that txn.priceX18 > 0, allowing donation attacks](https://0xsimao.com/findings/vertex-offchain-validate-price-donation): Vertex