n1punp - Missing slippage control validation in opening position function in AuraSpell

[sherlock-admin]

n1punp

high

Missing slippage control validation in opening position function in AuraSpell

Summary

Missing slippage control validation in opening position function in AuraSpell

Vulnerability Detail

Users who try to open position in Aura pool via Blueberry can get sandwiched attack, leading to the user potentially getting 0 lp amount from swaps, and the tx will still succeed.

Impact

All your farmers to the Aura pool will get sandwiched and wrecked.

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/AuraSpell.sol#L63-L147

Tool used

Manual Review

Recommendation

• Add slippage control for minLPAmount and check with the obtained lpAmount.

Duplicate of #121