# FeeBurner initiates swap without any slippage checks if Chainlink oracle fails 

FeeBurner swaps fall back to zero min_out when Chainlink oracle fails, letting attackers sandwich swaps and extract value.

- Payout: Contest reward
- Severity: medium
- Program: Backd
- Credited: Ruhum
- Disclosed: 2022-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-backd-findings/issues/44
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-backd%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** FeeBurner/SwapperRouter swap contracts
**Root cause:** SwapperRouter._minTokenAmountOut returns 0 when the Chainlink oracle fails, and that 0 is used as the slippage min_out for the swap.
**Steps:**
1. FeeBurner.burnToTarget() initiates a swap via SwapperRouter
2. SwapperRouter calls _minTokenAmountOut() to compute min_out
3. When Chainlink oracle fails, minTokenAmountOut() returns 0
4. Swap executes with min_out=0, no slippage protection
5. Attacker sandwiches the swap to extract value
**How found:** Code reading of FeeBurner's dependency on SwapperRouter revealed the oracle-failure branch returning 0 for min_out, removing slippage protection.
**Exploitation:** Attacker observes a pending FeeBurner swap whose oracle is unavailable (min_out=0), front-runs to move price, lets the unprotected swap execute at the worse price, then back-runs to capture the difference.
**Insight:** Trace oracle-failure fallback branches in swap routers: a default of 0 for min_out silently disables slippage checks and turns any swap into a sandwich target.