PositionActionPendle exits pendle without slippage protection

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-10-loopfi/blob/d219f0132005b00a68f505edc22b34f9a8b49766/src/proxy/PositionActionPendle.sol#L64-L74

Vulnerability details

Proof of Concept

PositionActionPendle exits pendle without slippage protection which will leave functions dependent on the _onWithdraw hook vulnerable to sandwich attacks.

The hardcoded PoolActionParams in _onWithdraw hardcodes the minimum amount out to 0, meaning any amount received from pendle interaction is accepted without any issues.

        if (dst != collateralToken && dst != address(0)) {
            PoolActionParams memory poolActionParams = PoolActionParams({
                protocol: Protocol.PENDLE,        
>>>             minOut: 0,                 
                recipient: address(this),      
                args: abi.encode(
                    collateralToken,          
                    collateralWithdrawn,       
                    dst                        
                )
            });

These params are passed on to exit in PoolAction.sol

    function exit(PoolActionParams memory poolActionParams) public returns (uint256 retAmount) {
        if (poolActionParams.protocol == Protocol.BALANCER) {
            retAmount = _balancerExit(poolActionParams);
>>>     } else if (poolActionParams.protocol == Protocol.PENDLE) {
            retAmount = _pendleExit(poolActionParams);
        } else revert PoolAction__exit_unsupportedProtocol();
    }

Which is the called when redeeming while exiting pendle.

    function _pendleExit(PoolActionParams memory poolActionParams) internal returns (uint256 retAmount) {
        (address market, uint256 netLpIn, address tokenOut) = abi.decode(
            poolActionParams.args,
            (address, uint256, address)
        );

//...

>>>     return SY.redeem(poolActionParams.recipient, netSyToRedeem, tokenOut, poolActionParams.minOut, true);
    }

Since the contracts are deployed on Ethereum, which is notorious for MEV bots and frontrunning, malicious users can monitor transactions that rely on _onWithdraw hook to gain unfair advantages and disrupt protocol operations for their own benefit.

Recommended Mitigation Steps

Recommend allowing the minOut to be specified, or hardcoding a more conventional amount, e.g 95% or using a setter function that allows the owner set the value.

Assessed type

MEV

[c4-judge]

koolexcrypto marked the issue as satisfactory