# Missing slippage bound on value-moving swaps

Value-moving swap, deposit or redemption leg with no caller-chosen min-out or price band

_Area: DeFi oracles, liquidations and flash loans. Seen in 34 disclosed reports; latest 2025-06-27. Updated 2026-10-23._

## How it works
A swap, deposit or redemption executes at whatever rate the pool offers at that moment. The code assumes that rate is fair, but an attacker can move it within the same block (front-run, then back-run). Without a minimum output or price band enforced on that leg, the operation accepts the manipulated rate. The root cause is a missing invariant: the realized rate is never required to fall within a bound chosen by whoever bears the loss (the user, or the protocol for its own liquidity).

## Where it shows up
- Router calls (`swapExactTokensForTokens`, `exactInputSingle`, `addLiquidity`, `removeLiquidity`) with min-amount `0` or `amountOutMinimum: 0` [E7](https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken.md).
- UniV3 swaps with `sqrtPriceLimitX96` hardcoded to MAX/MIN, equivalent to zero protection [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-9.md).
- A min-out field exists in a struct or signature but is not forwarded, or is overwritten by a helper [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-4.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-9.md).
- Multi-leg trades where only one leg carries the check; a conditional skip leaves the other leg unprotected [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-3.md).
- Deposit paths that bound input amounts but not output shares/LP tokens [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-4.md).
- Protocol-owned liquidity added at an oracle price with 100% slippage tolerance [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6.md).
- Token-level `buyToken`/swap functions that touch an AMM pool with no bound, drained via repeated swaps and skim-style reserve manipulation [E7](https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250304-pump.md).

## How to review
Trace every value-moving call to the router or pool and confirm a non-zero bound reaches it. The invariant: for each leg that can move price, realized output must be >= a bound chosen by the party bearing the loss (or within a chosen price band), enforced on that leg independently. A correct bound looks like: caller-supplied min-out plus a deadline, or explicit sqrt-price lower/upper bounds on the addLiquidity leg. Checklist: (a) struct fields are actually forwarded, not just declared or overwritten [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-4.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-9.md); (b) for deposits minting shares, the user can bound output shares, not just inputs [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-4.md); (c) for deposits minting no shares, the underlying addLiquidity accepts price-deviation bounds [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6.md); (d) values used for sizing (debt, balances) cannot be mutated between sizing and execution [E6](https://bugbountylibrary.com/r/cantina%3Aliquity_april2025%3A3.1.2.md); (e) token-internal swap/buy functions and pool setup enforce a bound, not just external router calls [E7](https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250304-pump.md).

## Variants seen
- Conditional second leg skipped, leaving first leg's `limit=0` exposed [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-3.md).
- Private vault deposit with no sqrt-price bounds; oracle checks skipped in AMM-only mode [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6.md).
- Deposit bounds inputs only; multi-fee-tier inflation collapses LP ratio [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-4.md).
- User slippage param dropped or overwritten by a pro-rata helper [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-4.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-9.md).
- Hardcoded MAX/MIN `sqrtPriceLimitX96` in a UniV3 swap [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-9.md).
- Swap sized from live debt, manipulable before execution [E6](https://bugbountylibrary.com/r/cantina%3Aliquity_april2025%3A3.1.2.md).
- Token-level swap/buy with no bound, drained via repeated swaps and skim [E7](https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250304-pump.md).

## Impact and severity
Direct user or protocol fund loss via sandwich/MEV, rated high in the evidence [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-3.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-4.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-4.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-9.md)[E6](https://bugbountylibrary.com/r/cantina%3Aliquity_april2025%3A3.1.2.md)[E7](https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250304-pump.md). Worse when protocol-owned liquidity or shared vaults are traded [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6.md)[E7](https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250304-pump.md), when no oracle fallback exists [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6.md), and when the loss is silent (fewer shares minted, overpaid swap) rather than a revert [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-4.md)[E6](https://bugbountylibrary.com/r/cantina%3Aliquity_april2025%3A3.1.2.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-4.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-4.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-9.md
- E6: https://bugbountylibrary.com/r/cantina%3Aliquity_april2025%3A3.1.2.md
- E7: https://bugbountylibrary.com/r/dhl%3A20250416-ybtoken.md
- E8: https://bugbountylibrary.com/r/dhl%3A20250304-pump.md