0x6a70 - Hardcoded amountAMin and amountBMin in __liquidateUnchecked function will lead to loss of funds.

[sherlock-admin2]

0x6a70

High

Hardcoded amountAMin and amountBMin in __liquidateUnchecked function will lead to loss of funds.

Summary

The values for amountAMin and amountBMin in __liquidateUnchecked are set to 0 , this will lead to loss of funds for users.

Vulnerability Detail

When a user redeems LV with the redeemEarlyLv or redeemExpiredLv functions which both use __liquidateUnchecked function which calls ammRouter.removeLiquidity , both of the amountAMin and amountBMin are hardcoded to 0. The protocol states that :"amountAMin & amountBMin = 0 for 100% tolerence", but the problem is that calling the function with a lack of slippage protection may cause user to receive unexpected amounts of tokens. A malicious user can take advantage and front run the transaction causing severe loss for the user, which may receive much lower amount or 0 of (raReceived, ctReceived).

Impact

This issue will lead to loss of funds for users, so the impact will be high.

Code Snippet

VaultLib.sol::__liquidateUnchecked
Information on the topic and why it should not be set to 0.
RareSkills
DefiHacksLabs

Tool used

Manual Review

Recommendation

Allow user to provide amounts for amountAMin and amountBMin.

Duplicate of #66