ERC20TokenEmitter lacks slippage protection

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/ERC20TokenEmitter.sol#L152

Vulnerability details

Impact

ERC20TokenEmitter uses VRGDA model to get the current price of the ERC20 token issued in exchange for ETH. Buyers are vulnerable to the price slippage due to price adjustments incurred by the VRGDA algorithm (price increases if amount sold is ahead of schedule and vice versa).

Proof of Concept

When user calls payable buyToken function, the contract calculates the amount it will mint to the user based on msg.value and the amount of emitted tokens
https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/ERC20TokenEmitter.sol#L184

        return
            vrgdac.yToX({
                timeSinceStart: toDaysWadUnsafe(block.timestamp - startTime),
                sold: emittedTokenWad,
                amount: int(etherAmount)
            });
    }

If this transaction was frontrunned or executed later, the user may receive fewer tokens than he expected (e.g. the transaction was executed when the amount sold is ahead of schedule).

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding deadline and minAmountOut checks

function buyToken(
        address[] calldata addresses,
        uint[] calldata basisPointSplits,
        ProtocolRewardAddresses calldata protocolRewardsRecipients
        uint256 deadline,
        uint256 minAmountOut
    ) public payable nonReentrant whenNotPaused returns (uint256 tokensSoldWad) {
        require(deadline > block.timestamp, "expired");
        ...
        require(uint256(totalTokensForBuyers) >= minAmountOut), "amount too small") 

Assessed type

Token-Transfer

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #26

[c4-pre-sort]

raymondfam marked the issue as duplicate of #397

[c4-judge]

MarioPoneder marked the issue as satisfactory