n1punp - Missing slippage control when closing position in AuraSpell

[sherlock-admin]

n1punp

high

Missing slippage control when closing position in AuraSpell

Summary

Missing slippage control when closing position in AuraSpell

Vulnerability Detail

There's no slippage control for minimum out tokens obtained.

Impact

Farmers who close positions in AuraSpell can potentially get sandwich-attacked and get $0 value out. (the attacker can manipulate the pool so the swap gets very bad rate). Right now all swaps get 0 min token amount out for slippage control and there are no other checks.

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/AuraSpell.sol#L149-L224

Tool used

Manual Review

Recommendation

• Add slippage control to all tokens in the closePositionFarm function

Duplicate of #121