Description

When a user exits the OrigamiLovToken, a percent of their reserves are kept as an exit fee. As such, the ratio of reserve to supply tokens is increased. This increases the price of the shares of the remaining users in the vault and can have undesired side effects.

function exitToToken(
	address /*account*/,
	IOrigamiInvestment.ExitQuoteData calldata quoteData,
	address recipient
) external virtual override onlyLovToken returns (
	uint256 toTokenAmount,
	uint256 toBurnAmount
) {
	...
	// The entire amount of lovTokens will be burned
	// But only the non-fee portion is redeemed to reserves and sent to the user
	toBurnAmount = quoteData.investmentTokenAmount;
	uint256 reservesAmount = exitFeeRate.getRemainder(toBurnAmount);
	...
	reservesAmount = _sharesToReserves(cache, reservesAmount);
	...
}

  function exitToToken(
...
      if (lovTokenToBurn > 0) {
          _burn(address(_manager), lovTokenToBurn);
      }
  }

Impact

One potential form of arbitrage that is rendered possible by the increase in share price would be a just-in-time (JIT) liquidity arbitrage. This involves MEV front-running a user's exitToToken call, adding liquidity before the exit and removing liquidity after the exit. By doing this, the arbitrager can capture exit-fee funds that should be distributed to other pool holders. Consequently, the pool loses the opportunity to grow.

However, it is important to note that various factors make this very unlikely, as the asset/liability (A/L) limits prevent large entries and exits of the pool; otherwise, arbitrageurs risk losing funds on gas prices and the exit fee they will face when exiting.

Recommendations

Ensure that A/L limits are sufficiently strict and that exit-fee rates are sufficiently low as to render these attacks unprofitable. Otherwise, implement a slow distribution of exit-fee tokens, rendering these attacks impossible.

Remediation

The exit fee system has now been redesigned in commit 92874a88↗, changing dynamically with respect to the spot price against the historical price. The best case scenario for an exit arbitrageur is when the spot price is greater than the historical price, as this is when the deposit fee is the lowest (minFeeBps) and the exit fee bps is the highest. However, this fee is also capped to the possible prices that the oracle can return, furthermore reducing risk of such attacks during volatile moments.

Furthermore, it is very unlikely that a large enough exit is possible to render such an arbitrage profitable considering gas, A/L limits will be hit, daily circuit breakers will go off and the maximum dynamic fee possible as a consequence of the oracle price range checks.