LiquidityExtension Is Vulnerable To Sandwich Attacks

[code423n4]

Handle

leastwood

Vulnerability details

Vulnerability details

Impact

The purchaseAndBurn function in LiquidityExtension is called by the Auction contract when users purchase arbitrage tokens. An attacker can monitor the blockchain for calls to this function and launch a sandwich attack to steal funds, assuming the attacker is a well-funded actor.

A malicious user is potentially able to steal rewards from users. As such, this issue should be considered medium risk as this results in loss of funds, but requires the attacker to be well-funded.

Proof of Concept

Consider the following scenario:

• An attacker buys Malt tokens from the uniswap pool.
• They frontrun a user calling purchaseArbitrageTokens.
• The user buys Malt tokens at an inflated price.
• The attacker sells their Malt tokens and profits.

As shown above, attackers are able to siphon funds from users overtime.

https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/Auction.sol#L184
https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/LiquidityExtension.sol#L124
https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/DexHandlers/UniswapHandler.sol#L131-L158

Tools Used

Manual code review
Referenced Mochi review.

Recommended Mitigation Steps

Consider performing slippage checks when users purchase arbitrage tokens by calling purchaseArbitrageTokens. This can be done by simply performing a lower bounds check on the output amount received when exchanging rewards tokens for Malt tokens. This change would need to be added into the purchaseAndBurn function in LiquidityExtension.

[0xScotch]

#219

[GalloDaSballo]

Duplicate of #219