No slippage protection for ERC20TokenEmitter.buyToken

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/ERC20TokenEmitter.sol#L184

Vulnerability details

Proof of Concept

Using ERC20TokenEmitter.buyToken function anyone can buy erc20 voting tokens. buyToken function uses vrgda approach to calculate token's price. The goal of vrgda is to sell fixed amount of tokens per unit of time. Depending on the current sold amount in this unit vrgda can decrease or increase price to attract buyers or vice versa.

Because of the described behavior of vrgda it means that price of erc20 token is not stable and changes after each call and time. Thus the function needs slippage protection, so buyer can get at least minimum amount that he is agreed and revert otherwise and not cause loses for the caller.

Impact

No slippage control for the caller.

Tools Used

VsCode

Recommended Mitigation Steps

Add additional param, like minErc20Amount, as slippage protection. Also you can add expire check as well.

Assessed type

Error

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[c4-pre-sort]

raymondfam marked the issue as duplicate of #397

[c4-judge]

MarioPoneder marked the issue as satisfactory