_payDebt() Lack of slippage protection

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-05-bakerfi/blob/59b1f70cbf170871f9604e73e7fe70b70981ab43/contracts/core/strategies/StrategyLeverage.sol#L545

Vulnerability details

Vulnerability details

in _payDebt() will perform the following steps

1. calculate how much amountIn is needed to pay back debtAmount + fee by using the quoteExactOutputSingle() method
2. call _withdraw(amountIn) to retrieve ierc20A.
3. call _swap(maxAmountIn = amountIn) to get debtAmount + fee.

      function _payDebt(uint256 debtAmount, uint256 fee) internal {
        _repay(wETHA(), debtAmount);
        // Get a Quote to know how much collateral i require to pay debt
        (uint256 amountIn, , , ) = uniQuoter().quoteExactOutputSingle(
@>          IQuoterV2.QuoteExactOutputSingleParams(ierc20A(), wETHA(), debtAmount + fee, 500, 0)
        );    
        
@>      _withdraw(ierc20A(), amountIn, address(this) );

        uint256 output = _swap(
            ISwapHandler.SwapParams(
                ierc20A(),
                wETHA(),
                ISwapHandler.SwapType.EXACT_OUTPUT,
@>              amountIn,
                debtAmount + fee,
                _swapFeeTier,
                bytes("")
            )
        );
        // When there are leftovers from the swap, deposit then back
        uint256 wethLefts = output > (debtAmount + fee) ? output - (debtAmount + fee) : 0;
        if (wethLefts > 0) {
            _supply(wETHA(), wethLefts);
        }
        emit StrategyUndeploy(msg.sender, debtAmount);
    }

The first step to get amountIn uses the real time price, then in the third step the amountIn is used as the Max Amount In.

It's all real-time pricing, and there is no slippage protection

Impact

vault.rebalance()->strategy.harvest() ->_adjustDebt()->_payDebt() Sandwich attack to manipulate prices

Recommended Mitigation

Adding slippage protection: range calculation via TWAP prices

Assessed type

Context

[c4-judge]

0xleastwood changed the severity to 3 (High Risk)

[c4-judge]

0xleastwood marked the issue as duplicate of #32

[c4-judge]

0xleastwood marked the issue as satisfactory