n1punp - No slippage control when closing position in ConvexSpell

[sherlock-admin]

n1punp

high

No slippage control when closing position in ConvexSpell

Summary

No slippage control when closing position in ConvexSpell

Vulnerability Detail

No slippage control when closing position in ConvexSpell, specifically remove_liquidity_one_coin can output almost 0 tokens, if the attacker sandwich attack so the desired is very very expensive (low liquidity in the underlying pool).

Impact

Attacker can sandwich attack users when they want to close position in ConvexSpell, leading to users getting nothing out (0 tokens).

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/ConvexSpell.sol#L147-L230

Tool used

Manual Review

Recommendation

• Add slippage control for all tokens that are involved with swapping (including reward token CVX).

Duplicate of #121