Unprotected Swaps¶

Decentralized exchanges (DEXs) provide a core functionality of the decentralized finance (DeFi) ecosystem: programmatic swapping of one asset for another. The feature carries a broad range of products, from lending platforms to derivatives, and forms the foundation of the DeFi landscape.

Asset swaps on DEXs are prone to pricing inefficiencies, also called slippage, which produce suboptimal trade outcomes or outright exploitation.

DEX smart contracts let users define the maximum tolerable slippage for a trade by specifying the minimum number of tokens they expect to receive. A trade that cannot meet the condition reverts. Poor implementation or outright omission of that protection produces disastrous outcomes.

Consider the following vulnerability in a smart contract integrating Uniswap V2:

1
2
3
4
5
6
7
8

IUniswapRouterV2(ROUTER).swapExactTokensForTokens(
    toSwap,
    // @audit amountOutMin of zero tolerates unlimited slippage
    0,
    path,
    address(this),
    now
);

The second parameter, amountOutMin, specifies the minimum number of output tokens the trader expects. Set to 0, the trade proceeds regardless of the output amount. A second example:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
 tokenIn: inToken,
 tokenOut: getTokenisedAddr(_outToken),
 fee: 3000,
 recipient: address(this),
 deadline: block.timestamp + 60,
 amountIn: _amount - swapFee,
 // @audit amountOutMinimum of zero tolerates unlimited slippage
 amountOutMinimum: 0
 });

Setting amountOutMinimum to zero again allows unlimited slippage. The hardcoded fee is a second defect, causing swaps to fail once the pool's fee rises above the 3000 threshold.

Both oversights let an attacker manipulate prices and execute a sandwich attack. Inflating or deflating the price ahead of the vulnerable trade extracts significant profit at the expense of the protocol or its users.

Exploit Scenario¶

An attacker opens a collateralized debt position (CDP) with 10 A tokens as collateral to mint 100 Y tokens, then triggers the protocol into a manipulated swap in the A/Y pool. Absent slippage protection, the price moves without bound. Flash loans and related price manipulation techniques inflate or deflate the price and drain the pool's liquidity for token A. The protocol is left with bad debt, unable to recover sufficient collateral, while the attacker sells the minted Y tokens at a profit and leaves the loss with the protocol and its users.

Limitations of Slippage Protection¶

Even with slippage protection at, say, 0.5% maximum price deviation, trades remain susceptible to sandwiching attacks:

1. An attacker front-runs the target transaction by placing a buy order, increasing the price of the asset to be purchased.
2. The target trade executes at the inflated price, incurring a loss due to slippage.
3. The attacker finalizes the attack by selling the asset in a back-running transaction, profiting from the price difference.

Slippage limits reduce attacker profits without eliminating the vector, especially for volatile or low-liquidity assets. A malicious actor still profits off the difference between the trade's actual slippage and the maximum stipulated by the order. Slippage values therefore have to be sourced from outside the current transaction's context. Calculating them inside the swap transaction is worthless, because a frontrunning transaction has already had the opportunity to manipulate the data they are derived from.

Mitigations¶

A robust solution runs the trade as a two-step commit-reveal scheme:

1. Commit Phase: Users submit a cryptographic commitment to their trade details (e.g., asset pair, amount, and slippage tolerance). This hides critical information from attackers.
2. Reveal Phase: After the commit phase is finalized, users disclose the trade details, and the transaction is executed.

The scheme makes anticipating and exploiting a transaction substantially harder, which blunts both sandwiching and slippage-based attacks.

Further mitigations layer on top. Dynamic slippage limits adjust tolerances to market conditions and trade size, which reduces exposure in volatile markets. Time-weighted average price (TWAP) feeds counteract short-term price manipulation and produce more accurate pricing. Private transactions through MEV-protected mempools conceal transaction details until inclusion in a block, denying attackers the chance to target a trade in advance. Liquidity analysis confirms that trading pools hold enough liquidity to absorb large trades without a price impact worth exploiting.