💀Understanding the "Lack of Slippage Check" Vulnerability in Automated Market Makers (AMMs) and DEXs

Book an audit with Zokyo

Introduction

The world of Decentralized Finance (DeFi) has brought about innovations like Automated Market Makers (AMMs) and decentralized exchange (DEX) pools, providing users with a trustless and decentralized way to trade assets. While the advantages of such systems are aplenty, they aren't without potential pitfalls. One vulnerability that stands out prominently is the "Lack of Slippage Check."

Breaking Down the Vulnerability

In traditional finance, the term "slippage" refers to the difference between the expected price of a trade and the price at which it's actually executed. It's a concept that's been carried into the world of DeFi, but with a unique twist.

When Alice places an order on a conventional centralized exchange, she can specify a maximum slippage or the worst price she's willing to accept. This is her way of saying, "I want this trade, but not if the price slips beyond X."

On the contrary, AMMs and DEX pools, by design, calculate prices algorithmically based on the liquidity and asset ratio in the pool. If these protocols don't embed robust slippage checks, users like Alice cannot set a minimum acceptable price, leaving a window of opportunity for malicious actors.

The Mechanics of the Exploit

To further grasp this vulnerability, consider the following scenario:

Alice decides to trade her Ethereum (ETH) for a stablecoin, say USDC, on a decentralized exchange. When she initiates the trade, she's expecting to get 400 USDC for each ETH.

Now, Bob, a malicious actor with ample resources, spots Alice's transaction waiting in the Ethereum mempool (the holding area for all pending transactions). Since there's no slippage check, Bob can exploit this in two steps:

1. Bob buys a significant amount of ETH from the pool, causing its price to spike temporarily.

2. Alice's transaction goes through, and she receives far less USDC than expected due to the inflated price of ETH.

3. Bob then sells back the ETH he bought, bringing the price back down and profiting from the difference.

This is a simplified example of a "sandwich attack," where Alice's trade gets sandwiched between two trades made by the attacker, causing her to get a worse deal.

Why It Matters

Beyond the obvious financial implications for individual traders, the lack of slippage checks can undermine trust in the DeFi ecosystem. DeFi's core value proposition hinges on decentralization and trustlessness. If users fear they could be exploited, they may become less likely to engage, slowing the growth and adoption of these platforms.

Mitigating the Threat

Several strategies can protect against this vulnerability:

1. Implement Minimum Return Values: Just like in our Alice example, allowing users to set a minimum amount they expect to receive can act as a safeguard. e.g:

    function swapAforB(uint256 amountIn, uint256 minAmountOut) external {
        require(amountIn > 0, "Amount should be greater than 0");
        
        uint256 amountOut = getAmountOut(amountIn);
        require(amountOut >= minAmountOut, "Slippage exceeded: Insufficient output amount");

1. Transaction Deadlines: By setting a deadline, or a block by which a transaction must be executed, it becomes harder for attackers to sandwich a trade.

2. Monitoring and Alerts: Platforms can monitor for suspicious trading patterns, alerting users or even halting trades if malicious activity is detected.

3. Educating Users: A well-informed user base can take steps to protect themselves, such as avoiding trading during times of high volatility.

Conclusion

While the world of DeFi holds incredible promise, it's still a burgeoning field with its fair share of challenges. The "Lack of Slippage Check" vulnerability is a poignant reminder of the necessity for robust security measures and continuous vigilance. As the ecosystem matures, fostering an environment of safety and trust will be paramount.

Example:

Missing slippage checks · Issue #171 · code-423n4/2021-07-spartan-findingsGitHub