Slippage check not performed during compoundReward
function
The compoundRewards
function from RewardCampaignManager
does not perform slippage checks when swapping the reward token for WOO tokens. Slippage checks are an important part of ensuring that the swap occurs on favorable terms. Without slippage checks, the contract is exposed to wild price fluctuations that could result in a significant loss of funds, depending on the traded amounts.
function compoundRewards(address _user) public onlyAdmin {
// ...
// ...
wooAmount += wooPP.swap(
_rewarder.rewardToken(), // fromToken
woo, // toToken
rewardAmount, // fromAmount
0, // minToAmount
// @audit-issue no slippage checks.
selfAddr, // to
selfAddr // rebateTo
);
// ...
}
We recommend adding slippage checks to the compoundRewards
function to ensure that the swap occurs on favorable terms.