Assessment reports>WOOFI Stake>Discussion>Slippage check not performed during compoundReward function

Slippage check not performed during compoundReward function

The compoundRewards function from RewardCampaignManager does not perform slippage checks when swapping the reward token for WOO tokens. Slippage checks are an important part of ensuring that the swap occurs on favorable terms. Without slippage checks, the contract is exposed to wild price fluctuations that could result in a significant loss of funds, depending on the traded amounts.

function compoundRewards(address _user) public onlyAdmin {
    // ...
    // ...
    wooAmount += wooPP.swap(
        _rewarder.rewardToken(), // fromToken 
        woo, // toToken
        rewardAmount, // fromAmount
        0, // minToAmount
        // @audit-issue no slippage checks.
        selfAddr, // to
        selfAddr // rebateTo
    );
    // ...
}

We recommend adding slippage checks to the compoundRewards function to ensure that the swap occurs on favorable terms.

Zellic © 2024Back to top ↑