Slippage issues in redeem()/addLiquiditySingleSy()/removeLiquiditySingleSy() in PendlePowerFarmLeverageLogic.sol

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PowerFarms/PendlePowerFarm/PendlePowerFarmLeverageLogic.sol#L170
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PowerFarms/PendlePowerFarm/PendlePowerFarmLeverageLogic.sol#L183
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PowerFarms/PendlePowerFarm/PendlePowerFarmLeverageLogic.sol#L472

Vulnerability details

Impact

Pendle pools can be very volatile especially in extreme market scenarios, when performing leverage tactics in PendlePowerFarmLeverageLogic.sol it makes interactions with the Pendle pools the issue here is that on the call to:

• addLiquiditySingleSy()
• redeem()
• removeLiquiditySingleSy()

The contract accepts that the minimum amount of tokens it receives to a minimum of zero.
Sample :

        uint256 tokenOutAmount = PENDLE_SY.redeem(
            {
                _receiver: address(this),
                _amountSharesToRedeem: netSyOut,
                _tokenOut: tokenOut,
                _minTokenOut: 0,
                _burnFromInternalBalance: false
            }
        );

Even this is specified in Pendle SDK.
https://api-v2.pendle.finance/sdk/#/

This is bad as an attacker can front-run the calls to cause the contracts to incur losses and backrun the tx to gain.
They require a slippage check to ensure the transactions do not end in loss to the caller.
This wouldn't revert the transaction and there loss of yield to the leverage strategy so I am labeling a high.

Tools Used

Manual review.

Recommended Mitigation Steps

As per the Docs use the underlying preview function to determine the supposed minimum amount out before performing the calls.

Assessed type

Other

[c4-pre-sort]

GalloDaSballo marked the issue as duplicate of #130

[c4-pre-sort]

GalloDaSballo marked the issue as sufficient quality report

[c4-judge]

trust1995 marked the issue as unsatisfactory:
Invalid

[shealtielanz]

Hi @trust1995 this issue isn't a duplicate of #130 please look into this.

[trust1995]

There is an overall before / after value check, which is a fair way for the project to deal with slippage.

[shealtielanz]

Hi @trust1995 remember that this is the PendlePowerFarmLeverageLogic, my point is that they wouldn't achieve the supposed yield they were initially supposed to receive from the strategy medium looks appropriate at least

[trust1995]

I respect your position but disagree.