An unguarded internal swap during fee-pool refill can be sandwiched for profit
- Severity
- High
- Class
- Value integrity
- System
- On-chain DeFi module
A refill swap runs without effective slippage protection, so anyone can sandwich it and siphon reserves from the pool.
When a fee pool topped itself up, it performed an internal swap that was supposed to be protected by a price guard. That guard was effectively dead code, so the swap executed at whatever price the surrounding transactions set.
A permissionless swap with no working slippage protection is an open invitation to sandwich it: bracket it with trades and pocket the difference, transaction after transaction.
Why it rated High
Repeatable, permissionless value extraction from protocol reserves, bounded only by liquidity.
The fix class
Enforce a real slippage bound on the refill swap and remove the guard that was never actually applied.
