# Relying solely on oracle base slippage parameters can cause significant loss due to sandwich attacks

AaveLeverageStrategyExtension computes swap slippage limits purely from Chainlink oracle prices, letting sandwich attackers exploit oracle deviation on rebalances for pool losses.

- Payout: Contest reward
- Severity: medium
- Program: Index
- Credited: 0x52
- Disclosed: 2023-05-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-Index-judging/issues/285
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** AaveLeverageStrategyExtension rebalance swap (min repay units)
**Root cause:** _calculateMinRepayUnits derives the minimum swap output solely from oracle collateral/borrow prices with a fixed slippage tolerance, ignoring actual pool state; Chainlink's ~2% deviation threshold means oracle price can diverge from true market price.
**Steps:**
1. Observe keeper-triggered rebalance calling _calculateMinRepayUnits with oracle-derived min output
2. Front-run the swap to move pool price against the rebalance
3. Let the rebalance execute at the oracle-derived (loose) min repay units, accepting worse-than-market fill
4. Back-run to restore price and capture the difference; leverage amplifies loss
**How found:** Code review of _calculateMinRepayUnits noticing the slippage bound is derived entirely from oracle prices; reasoning about Chainlink's deviation threshold creating a systematic gap exploitable by sandwiching.
**Exploitation:** Attacker sandwiches the keeper's rebalance swap; because the min-output bound is computed from stale/deviation-thresholded oracle prices rather than pool reserves, the swap tolerates a spread the attacker captures, and leverage multiplies the loss to the pool.
**Escalation:** Leverage module amplifies losses; volatile asset pairs compound oracle error.
**Insight:** When a protocol's swap slippage bound is computed from oracle prices rather than pool reserves, the oracle's deviation threshold becomes the attacker's profit margin—check rebalance/keeper swap functions for oracle-derived min-out values.