AutoPxGmx rewards can be drained

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/vaults/AutoPxGmx.sol#L242-L247
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexRewards.sol#L373

Vulnerability details

Impact

Vault rewards may be drained through a combination of claimRewards(),
compound(), and uniswap trades by the attacker.

Proof of Concept

1. Attacker calls claimRewards({producerToken: WETH, user: vault}) to get WETH into the vault.
2. Attacker calls compound({fee: poolFee, amountOutMinimum: 1, sqrtPriceLimitX96: 0, optOutIncentive: true}) . The attacker sandwiches this transaction with two transactions which purchase and sell WETH.
3. The vault loses most of its WETH rewards.

Recommended Mitigation Steps

Only allow compound() to be called by trusted operators. Additionally, consider calculating amountOutMinimum based on chainlink oracle prices.

[c4-judge]

Picodes marked the issue as duplicate of #183

[c4-judge]

Picodes marked the issue as duplicate of #185

[c4-judge]

Picodes marked the issue as satisfactory

[c4-judge]

Picodes changed the severity to 2 (Med Risk)

[C4-Staff]

JeeberC4 marked the issue as duplicate of #137