# The calculated value for slippage protection in the protocol is inaccurate

Alchemix RewardCollector computed slippage minimums from OP/USD and OP/ETH Chainlink prices instead of alUSD/alETH prices, enabling sandwich attacks on reward swaps.

- Payout: Contest reward
- Severity: high
- Program: Alchemix
- Credited: Bauer
- Disclosed: 2024-04-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-alchemix-judging/issues/5
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-alchemix%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** OptimismRewardCollector.getExpectedExchange / RewardRouter.distributeRewards
**Root cause:** getExpectedExchange derives expected output from OP/USD and OP/ETH Chainlink feeds, but the actual swap output is alUSD or alETH whose prices deviate from USD/ETH, so the minimumAmountOut is mispriced.
**Steps:**
1. RewardRouter.distributeRewards sends OP to OptimismRewardCollector and calls claimAndDonateRewards with minOut = getExpectedExchange(vault) * slippageBPS / BPS
2. getExpectedExchange reads opToUsd and ethToUsd Chainlink feeds
3. For alUSD: expectedExchange = totalToSwap * opToUsd / 1e8; for alETH: totalToSwap * opToUsd / ethToUsd
4. Swap executes via Velodrome OP->USDC->alUSD or OP->alETH with that minimumAmountOut
5. Because alUSD/alETH price != USD/ETH, the minOut is too loose/tight, allowing a sandwicher to move the pool and extract value
**How found:** Code reading of getExpectedExchange: noticed the slippage minimum is computed from OP/USD and OP/ETH feeds while the swap target tokens are alUSD and alETH, whose prices are not pegged 1:1 to USD/ETH.
**Exploitation:** Attacker observes the pending distributeRewards/claimAndDonateRewards swap, front-runs to skew the Velodrome OP/alUSD or OP/alETH pool, lets the mispriced minimumAmountOut swap execute at a worse rate, then back-runs to capture the difference.
**Insight:** When auditing slippage/minOut logic, verify the price feed used matches the actual output asset, not an intermediate or assumed-pegged asset; LSD/stable wrappers like alETH/alUSD deviate from their underlying.