# During voting the attacker's refund is vulnerable to a sandwich attack

Voting.sol _tryFinalize sells wstETH for WETH with no slippage check, letting a flash-loan sandwich steal the loser's refund during votingClaimFor.

- Payout: Contest reward
- Severity: high
- Program: Goat
- Credited: Spearmint
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_goat_mar2024.pdf#3.1.16
- Library page: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.16
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** Voting.sol _tryFinalize refund swap via Controller.votingClaimFor
**Root cause:** _tryFinalize calls LLido.sellWsteth(toWinnerVal) then wethToEth with no minimum-output/slippage check, so the refund swap executes at whatever price the pool offers.
**Steps:**
1. Identify a vote that passed quorum but has not ended/finalized.
2. At vote end, take a flash loan and swap wstETH→WETH to inflate WETH price.
3. In same tx call `Controller.votingClaimFor` which invokes `_tryFinalize` in Voting.sol.
4. _tryFinalize runs `LLido.sellWsteth(toWinnerVal); LLido.wethToEth(); to.send(...)` at the inflated price, giving attacker far less WETH.
5. Swap acquired WETH back to wstETH at profit, pocketing the difference.
**How found:** Code reading of _tryFinalize's refund path: noticed the Uniswap sell of wstETH had no slippage/min-out parameter, making the swap price manipulable.
**Exploitation:** Flash-loan capital inflates the wstETH/WETH pool price, then the victim's refund swap in _tryFinalize executes at the manipulated rate; attacker unwinds the position in the same transaction and captures the value lost by the refund recipient.
**Insight:** Any protocol-internal swap that pays out to a user (refunds, liquidations, fee conversions) is a sandwich target if it lacks a min-out; check finalize/claim/settle functions that call AMM routers with computed amounts.