# Defeatable per-call slippage and search bounds

Bounds that limit one call or approximate an optimum, defeatable by price moves or repetition

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-01-08. Updated 2026-10-29._

## How it works
A swap, compound, or rebalance path does have a bound (slippage, deviation, min-return), but the bound only constrains a single call or is computed by an approximate search. The broken assumption: that a per-call cap protects the protocol. It does not when the amount is chosen by an iterative search that can miss profitable ranges [E1](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-16.md), when an outside actor can push price past the bound to force a revert [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-9.md), or when the bounded call can be repeated in one tx [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-2.md). Value leaks to whoever moves the price or times entry/exit.

## Where it shows up
- Iterative/bisection search for an optimal swap or arbitrage amount instead of a closed-form solution [E1](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-16.md)
- Compounding/harvest swap with a tight oracle-based slippage bound an outside swap can push past [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-9.md)
- Rebalance/swap with per-call slippage/deviation checks but no cooldown or cumulative-loss limit [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-2.md)
- Failed harvest/compound leaving rewards in-contract for later depositors [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-9.md)
- Bounds derived from a price an external actor can move

## How to review
Check the invariant: worst-case loss per unit time (not per call) is bounded, and the bound cannot be defeated by an external price move or by repeating the call in one tx/block. Concretely: does a closed-form optimum exist and is it used, and can the search range exclude profitable amounts [E1](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-16.md)? Can an attacker move price to make the bound revert, and what state is left behind [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-9.md)? Is there a cooldown or cumulative cap across calls [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-2.md)? Trace what happens to funds when the bounded operation fails.

## Variants seen
- Approximate search misses profitable arbitrage range and is sandwichable [E1](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-16.md)
- Slippage bound griefed to revert compounding, then deposit/redeem to capture rewards [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-9.md)
- Per-call slippage cap multiplied by repeated rebalance in one tx [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-2.md)

## Impact and severity
Missed/suboptimal arbitrage profit and sandwich exposure [E1](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-16.md); theft of rewards meant for prior depositors [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-9.md); up to ~26% of vault funds drained by a compromised operator repeatedly rebalancing [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-2.md). Note E3 is a trusted-role drain, not sandwich/arbitrage; E2's griefing requires attacker capital and timing. Severity rises when the bounded call is repeatable or failed operations leave capturable value in-contract.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-16.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-9.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-2.md