# Suboptimal arbitrage implementation

Salty.IO's bisection search for optimal arbitrage amount can miss profitable arbitrage entirely and enables sandwich attacks, due to approximate instead of exact formula.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: fnanni
- Disclosed: 2024-04-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/419
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** ArbitrageSearch.sol _bisectionSearch()
**Root cause:** The bisection search approximates the optimal arbitrage amount instead of using the exact closed-form solution, leading to missed profitable ranges and suboptimal profits.
**Steps:**
1. Identify arbitrage profit function f(a) = n1*a/(n2+m*a) - a with n1=C1*B1*A1, n2=C0*B0*A0, m=C0*B0+C0*A1+B1*A1.
2. Derive exact optimal a = (sqrt(A0*A1*B0*B1*C0*C1) - n2)/m when n1>n2.
3. Show bisection search can test only unprofitable range if 1/128th of swap amount x > a0=(n1-n2)/m, missing profits.
4. Construct pool states satisfying C0 > 255*B1*A1/(A1+B0) to demonstrate missed arbitrage for 2-2000 ETH<>BTC swaps.
5. Sandwich: pre-transaction pushes pools into missed-profit state, post-transaction captures arbitrage profits meant for DAO.
**How found:** The researcher analyzed the arbitrage profit function and noticed the bisection search is an approximation; derived the exact formula and identified conditions where the search range excludes profitable amounts.
**Exploitation:** An attacker can sandwich a user swap: first swap pushes pool reserves into a state where the protocol's bisection search finds no profitable arbitrage, then after the user's swap, the attacker performs the arbitrage themselves, capturing profits that would have gone to the DAO.
**Insight:** When a protocol uses iterative search for an optimum, check if a closed-form solution exists and whether the search range can miss profitable regions; also consider how external actors can manipulate pool states to exploit the search's inaccuracy.