SellMalt() is open to frontrunning

[code423n4]

Handle

jayjonah8

Vulnerability details

Impact

The sellMalt() function in UniswapHandler.sol can be called by anyone and can also be frontrun because it just checks the rewards tokens in the contract and sends them to the msg.sender.

Proof of Concept

https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/DexHandlers/UniswapHandler.sol#L160

Tools Used

Manual code review

[0xScotch]

#120

[GalloDaSballo]

Finding is not a duplicate of #120
This finding is saying that sell malt allows the caller to take all the reward tokens

However these tokens are the outcome of the swap and are sent to each caller each time.
I don't believe there can be any meaningful frontrun nor stealing of funds.
Obviously nobody should sent their malt and then call sellMalt the operation has to be done in a single tx, which the system as a whole already does

Marking as invalid