Bauer - AuraSpell executes swaps without slippage protection

[sherlock-admin]

Bauer

high

AuraSpell executes swaps without slippage protection

Summary

The AuraSpell protocol executes swaps without slippage protection. That will cause a loss of funds because of sandwich attacks.

Vulnerability Detail

In AuraSpell .closePositionFarm() swaps are executed through the swapRouter.The amountOutMin value has been set to 0. Without slippage protection, this is vulnerable to sandwich attacks

for (uint256 i = 0; i < rewardTokens.length; i++) {
            uint256 rewards = _doCutRewardsFee(rewardTokens[i]);
            _ensureApprove(rewardTokens[i], address(swapRouter), rewards);
            swapRouter.swapExactTokensForTokens(
                rewards,
                0,
                swapPath[i],
                address(this),
                type(uint256).max
            );
        }

Impact

Swaps will be sandwiched causing a loss of funds for users you withdraw their rewards.

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/AuraSpell.sol#L196-L202

Tool used

Manual Review

Recommendation

Calculate the maximum output and set slippage protection

Duplicate of #121