No slippage applied when Withdrawing collateral from the vault and dst != collateralToken

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-10-loopfi/blob/d219f0132005b00a68f505edc22b34f9a8b49766/src/proxy/PositionActionPendle.sol#L55-L84

Vulnerability details

Proof of Concept

Take a look at https://github.com/code-423n4/2024-10-loopfi/blob/d219f0132005b00a68f505edc22b34f9a8b49766/src/proxy/PositionActionPendle.sol#L55-L84

    function _onWithdraw(
        address vault,
        address position,
        address dst,
        uint256 amount
    ) internal override returns (uint256) {
        uint256 collateralWithdrawn = ICDPVault(vault).withdraw(address(position), amount);
        address collateralToken = address(ICDPVault(vault).token());

        if (dst != collateralToken && dst != address(0)) {
            PoolActionParams memory poolActionParams = PoolActionParams({
                protocol: Protocol.PENDLE,
                minOut: 0,
                recipient: address(this),
                args: abi.encode(
                    collateralToken,
                    collateralWithdrawn,
                    dst
                )
            });

            bytes memory exitData = _delegateCall(
                address(poolAction),
                abi.encodeWithSelector(poolAction.exit.selector, poolActionParams)
            );

            collateralWithdrawn = abi.decode(exitData, (uint256));
        }
        return collateralWithdrawn;
    }

This function is used to withdraw collateral from the vault.

In the new scope there is a check to see if dst != collateralToken then a pool action param is then needed to withdraw the collateral from PENDLE, issue however is that when doing this we hardcode the slippage to 0, causing for loss of funds for users.

Impact

Loss of funds for users when withdrawing from the vault and dst != collateralToken, considering minOut has been hardcoded to 0 allowing even 0 value to be given to them post their exit from Pendle.

Recommended Mitigation Steps

Allow users pass in a slippage protected value and in the case where dst != collateralToken this value should be attached to minOut:

            PoolActionParams memory poolActionParams = PoolActionParams({
                protocol: Protocol.PENDLE,
-                minOut: 0,
+                minOut: _minOut,
                recipient: address(this),
                args: abi.encode(
                    collateralToken,
                    collateralWithdrawn,
                    dst
                )
            });

Assessed type

Context

[c4-judge]

koolexcrypto marked the issue as satisfactory

[c4-judge]

koolexcrypto changed the severity to 2 (Med Risk)