No Slippage Protection When Mint Liquidity

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/PanopticFactory.sol#L335

Vulnerability details

Impact

There is no slippage protection during the minting of full-range-liquidity. In the process, the slot0 is queried and there is no check from the user that the liquidity should be within an acceptable range. Thus user may suffer from loss when providing liquidity in Uniswap V3.

Proof of Concept

In PanopticFactory::deployNewPool, the full-range liquidity should be provided by msg.sender.

        // Mints the full-range initial deposit
        // which is why the deployer becomes also a "donor" of full-range liquidity
        // The SFPM will `safeTransferFrom` tokens from the donor during the mint callback
        (uint256 amount0, uint256 amount1) = _mintFullRange(v3Pool, token0, token1, fee);

In the _mintFullRange, the IUniswapV3Pool(v3Pool).mint is being called. But there is no slippage protection during the minting of full-range-liquidity. In the process, the slot0 is queried and there is no check from the user that the liquidity should be within an acceptable range.

        (uint160 currentSqrtPriceX96, , , , , , ) = v3Pool.slot0();
        ...
        return
            IUniswapV3Pool(v3Pool).mint(
                address(this),
                tickLower,
                tickUpper,
                fullRangeLiquidity,
                mintCallback
            );

Thus, if the pool has gone through prices changes before the mint, the user may suffer from slippage loss.

Tools Used

Manual

Recommended Mitigation Steps

It is recommended to add slippage protection in the function PanopticFactory::deployNewPool.

Assessed type

MEV

[c4-judge]

Picodes marked the issue as unsatisfactory:
Invalid

[c4-judge]

Picodes marked the issue as unsatisfactory:
Invalid

[Picodes]

It's a new pool so by definition there is no price to manipulate yet

[jes16jupyter]

Hi @Picodes I guess it's the duplicate of #537. Suffering from v3Pool.slot0() which could be manipulated.

[c4-judge]

Picodes marked the issue as duplicate of #537

[Picodes]

Indeed, thanks for flagging

[c4-judge]

Picodes marked the issue as satisfactory