No slippage control when withdrawing a position leads to loss of funds

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-10-superposition/blob/7ad51104a8514d46e5c3d756264564426f2927fe/pkg/seawater/src/lib.rs#L749

Vulnerability details

Impact

An attacker can sandwich a user withdrawing funds as there is no way to put slippage protection, which will cause a large loss of funds for the victim.

Proof of Concept

decr_position_09293696 function was removed entirely. Now, the only way for users to withdraw funds is by calling update_position_C_7_F_1_F_740 with negative delta.

The issue is that in this way, users can't have any slippage protection. decr_position allowed users to choose an amount_0_min and amount_1_min of funds to receive, which is now zero.

This allows an attacker to sandwich their withdrawal to steal a large amount of funds.

Recommended mitigation steps

Consider reintroducing a withdrawal function that offers slippage protection to users (they should be able to choose amount_0_min, amount_1_min, amount_0_desired, and amount_1_desired).

[alex-ppg]

The submission has demonstrated that liquidity withdrawals from the system are inherently insecure due to being open to arbitrage opportunities as no slippage is enforced.

I am unsure why the Sponsor has opted to acknowledge this submission as it is a tangible vulnerability and one that merits a high-risk rating. The protocol does not expose a secure way to natively extract funds from it whilst offering this functionality for other types of interactions.

[c4-judge]

alex-ppg marked the issue as selected for report

[c4-judge]

alex-ppg marked the issue as satisfactory

[af-afk]

@alex-ppg We won't fix this for now since Superposition has a centralised sequencer, and there's no MEV that's possible for a thirdparty to extract using the base interaction directly with our provider.

[DadeKuma]

@af-afk I highly suggest fixing this issue, as a centralized sequencer does not prevent MEV extraction. You can check this impact on Arbitrum for example: https://dune.com/datawarlock/arbitrum-mev-atomic-arbitrage