# Withdrawals from IchiVaultSpell have no slippage protection so can be frontrun, stealing all user funds

IchiVaultSpell withdrawal swaps on UniV3 with max/min sqrtPriceLimit, no slippage guard, letting MEV bots sandwich and drain user funds.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: rvierdiiev
- Disclosed: 2023-02-01
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/130
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** IchiVaultSpell.sol withdrawInternal UniV3 swap
**Root cause:** The UniV3 swap in withdrawInternal hardcodes sqrtPriceLimitX96 to MAX_SQRT_RATIO-1 / MIN_SQRT_RATIO+1, accepting the worst possible price, and uniswapV3SwapCallback performs no additional price check.
**Steps:**
1. User calls closePosition()/closePositionFarm() -> withdrawInternal()
2. LP tokens redeemed from Ichi vault into two underlying tokens
3. Non-borrowed token swapped to borrowed token via swapPool.swap with sqrtPriceLimitX96 = MAX_SQRT_RATIO-1 (or MIN+1)
4. Callback pays whatever delta Uniswap requests with no slippage check
5. MEV bot front-runs by trading same direction to skew price, then back-runs to profit
**How found:** Code review of withdrawInternal swap call; noticed sqrtPriceLimitX96 hardcoded to extreme bounds and callback lacking price validation; reasoned amountRepay is insufficient slippage protection when users repay little/none.
**Exploitation:** Attacker watches mempool for closePosition tx, sandwiches the UniV3 swap: large trade in same direction before victim pushes price to extreme, victim's swap executes at worst rate, attacker reverses trade pocketing the difference. Low-liquidity ICHI pairs (e.g. ICHI-WBTC <$350k) make majority-fund extraction feasible.
**Insight:** When auditing vault/leverage spells, check every UniV3 swap's sqrtPriceLimitX96 argument and the swap callback for price/amount checks; a hardcoded MAX/MIN limit is equivalent to zero slippage protection regardless of user-supplied repay params.