# Malicious user can prevent buying back OLAS token via Slipstream

Attacker frontruns buyBack by sending ETH to the Slipstream pool; refundETH then tries to send ETH to the non-payable BuyBackBurner proxy, reverting the swap and DoSing OLAS buybacks.

- Payout: Contest reward
- Severity: medium
- Program: Olas
- Credited: mrMorningstar
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-01-olas#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** BuyBackBurner / BuyBackBurnerBalancer proxy on Slipstream CL DEX
**Root cause:** Slipstream swapRouter.refundETH() forwards any ETH balance to msg.sender (the BuyBackBurner proxy), but the proxy's fallback delegatecalls into an implementation lacking receive/payable fallback, so the ETH transfer reverts and the whole swap reverts.
**Steps:**
1. Attacker frontruns `buyBack` by sending a small amount of ETH to the Slipstream pool contract.
2. Protocol calls `buyBack` -> `_buyOLAS` -> `_performSwap` -> `swapRouter.exactInputSingle`.
3. After swap, `exactInputSingle` calls `refundETH()`, which sees `address(this).balance > 0` and calls `safeTransferETH(msg.sender, balance)`.
4. `safeTransferETH` does `to.call{value: value}(new bytes(0))` to the BuyBackBurner proxy.
5. Proxy fallback delegatecalls empty calldata to implementation, which has no receive/payable fallback, reverting; proxy reverts; `require(success, "STE")` reverts the swap.
6. Attacker calls public `refundETH()` to reclaim their ETH, repeating at near-zero cost.
**How found:** Code review of the swap path: noticed `exactInputSingle` unconditionally calls `refundETH()` which sweeps the router's entire ETH balance to msg.sender, then traced that the recipient proxy lacks a payable receive path through its delegatecall fallback, causing safeTransferETH to revert.
**Exploitation:** Attacker needs only to frontrun each buyBack with a dust ETH transfer to the Slipstream pool. The protocol's swap reverts on the ETH refund, blocking OLAS buyback and transfer to Bridge2Burner. Attacker recovers ETH via the public refundETH, making the DoS cheap and repeatable.
**Insight:** When a DEX router sweeps its full ETH balance to msg.sender via refundETH, any third party can donate ETH to the router to force a refund call to your contract; if your contract is a proxy whose implementation lacks receive/payable fallback, the delegatecall reverts and bricks the swap. Check router refund semantics and proxy receive paths.