No slippage check during withdraw/deposit

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/V3Vault.sol#L877-#L917
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/V3Vault.sol#L920-#L952

Vulnerability details

Vulnerability details

The deposit/withdraw function in the V3Vault lacks a mechanism for users to express their minimum acceptable output. This deficiency exposes users to potential losses of their principal due to update of the rate

In the _deposit() function, amount and shares is directly converted to the other by calling _convertToAssets/_convertToShares() function, and it is rely on newLendExchangeRateX96. The update of newLendExchangeRateX96 can make user receive less shares/cost more amounts than they expected. This thing is similar in _withdraw() function. This scenario also can happen when user attempts to withdraw/deposit assets and their transaction is delayed due to low gas cost/network issue/reorg/ ..., which harming user

Impact

Users will loss assets due to the absence of slippage control in the withdraw/deposit function.

Tools Used

Manual review

Recommended Mitigation Steps

Add slippage checking when deposit/withdraw assets

Assessed type

Other

[c4-pre-sort]

0xEVom marked the issue as sufficient quality report

[c4-pre-sort]

0xEVom marked the issue as duplicate of #281

[c4-judge]

jhsagd76 changed the severity to QA (Quality Assurance)

[c4-judge]

jhsagd76 marked the issue as grade-b

[c4-judge]

This previously downgraded issue has been upgraded by jhsagd76

[c4-judge]

jhsagd76 changed the severity to QA (Quality Assurance)