# Theft of rewards via sandwich attack

Omnipool.swapForGem performs a Balancer batchSwap with infinite limits and no slippage protection, letting a sandwicher steal up to 100% of users' claimed rewards.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: cuthalion0x
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Omnipool.sol swapForGem / RewardManager.claimEarnings
**Root cause:** swapForGem calls Balancer batchSwap with int256 max limits and no minimum-out or oracle-derived bound, so any exchange rate is accepted. The claim pipeline never introduces slippage protection.
**Steps:**
1. User calls RewardManager.claimEarnings(), which routes to Omnipool.swapForGem().
2. swapForGem builds `int256[] limits = [type(int256).max, type(int256).max, type(int256).max]` and calls Balancer `batchSwap()`.
3. Attacker front-runs the claim, skewing the pool price for the reward token.
4. Victim's swap executes at the manipulated near-zero rate, accepting any output.
5. Attacker back-runs to restore price and captures the victim's reward value.
**How found:** Code review of the claim pipeline: traced RewardManager.claimEarnings into Omnipool.swapForGem and noticed the Balancer batchSwap used type(int256).max limits with no slippage bound anywhere in the path.
**Exploitation:** Sandwich: front-run the victim's claimEarnings transaction to move the Balancer pool price, let the victim's unlimited-limit batchSwap fill at a near-zero rate, then back-run to unwind and pocket the difference, capturing up to ~100% of the reward.
**Insight:** Trace user-facing claim/reward paths into their DEX swap calls and check the swap limits/min-out arguments; infinite or max limits on a reward-conversion swap turn every claim into a sandwichable order.