Buytoken function in ERC20TokenEmitters lacks of slippage parameters

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/ERC20TokenEmitter.sol#L152

Vulnerability details

Impact

Risk of users receiving significantly fewer ERC20Tokens than expected.

Proof of Concept

The prices of ERC20Tokens are dynamically calculated based on the implemented VRGDA. Consequently, purchasing ERC20Tokens leads to an increase in the token selling price.

Therefore, individuals purchasing ERC20Tokens by invoking the buyTokens function may receive significantly fewer tokens than expected, as they could potentially be front-run by another user acquiring tokens just before them.

Tools Used

Manual review.

Recommended Mitigation Steps

Consider adhering to best practices by introducing a slippage input parameter in the buyToken function to mitigate potential consequences of front-running for buyers.

By setting a zero slippage the slippage protection could be disabled allowing that auctions still can buy ERC20Tokens.

Assessed type

Invalid Validation

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #26

[c4-pre-sort]

raymondfam marked the issue as duplicate of #397

[c4-judge]

MarioPoneder marked the issue as satisfactory