# Vault executes swaps without slippage protection

Derby vault computes Uniswap amountOutMinimum inside the swap tx via Quoter, so sandwich attackers manipulate pool state and drain value from reward swaps.

- Payout: Contest reward
- Severity: high
- Program: Derby
- Credited: Bauer
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/64
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AH-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** Derby yield optimiser vault reward swaps
**Root cause:** amountOutMinimum is derived from IQuoter.quoteExactInput executed within the same transaction as the swap, so it reflects the attacker-manipulated pool state rather than a pre-committed off-chain quote.
**Steps:**
1. Identify `Swap.swapTokensMulti` used by `Vault.claimTokens()` and `MainVault.withdrawRewards()`.
2. Observe `amountOutMinimum = IQuoter.quoteExactInput(...)` is computed on-chain right before `exactInput`.
3. Attacker front-runs the reward swap, pushing pool price against the vault's swap direction.
4. Vault's Quoter now returns a low min-out consistent with the skewed pool, so `exactInput` executes at the bad price.
5. Attacker back-runs to restore price and captures the difference.
**How found:** Code review of the Swap library: noticed slippage min-out is calculated inside the swap transaction via the Quoter, which cannot protect against same-block manipulation.
**Exploitation:** Sandwich attack: front-run the vault's reward swap to skew the Uniswap pool, let the vault swap execute with a min-out computed from the manipulated pool, then back-run to profit at users' expense.
**Insight:** Any on-chain Quoter call used to set amountOutMinimum in the same tx as the swap is self-defeating; min-out must come from off-chain calldata signed/committed before the attacker can move the pool.