No slippage protection for adding liquidity in stableswap pool for add_liquidity()

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/stableswap/src/lib.rs#L475-L479

Vulnerability details

Impact

In stableswap pool, add_liquidity() lacks slippage protection, and users might lose shares due to trading activities or price manipulation.

Proof of Concept

In stableswap pool, slippage protection is not consistently implemented. Notably all other trading and liquidity management functions such as (sell(),buy(),add_liquidity_shares(), remove_liquidity_one_asset(),etc) have slippage protection, except for add_liquidity().

add_liquidity() takes an array of asset amount to add liquidity but allows for any calculated share amount (share_amount) to pass.

//HydraDX-node/pallets/stableswap/src/lib.rs
		pub fn add_liquidity(
			origin: OriginFor<T>,
			pool_id: T::AssetId,
|>			assets: Vec<AssetAmount<T::AssetId>>,//@audit no slippage protection parameter (e.g. min_share_amount)
		) -> DispatchResult {
...
			let shares = Self::do_add_liquidity(&who, pool_id, &assets)?;
...
}

	fn do_add_liquidity(
		who: &T::AccountId,
		pool_id: T::AssetId,
		assets: &[AssetAmount<T::AssetId>],
	) -> Result<Balance, DispatchError> {
...
		let share_amount = hydra_dx_math::stableswap::calculate_shares::<D_ITERATIONS>(
			&initial_reserves,//@audit-info note: old reserves
			&updated_reserves,//@audit-info note: new reserves
			amplification,
			share_issuance,
			pool.fee,
		)
		.ok_or(ArithmeticError::Overflow)?;
                //@audit only non-zero value is checked
|>		ensure!(!share_amount.is_zero(), Error::<T>::InvalidAssetAmount);
		let current_share_balance = T::Currency::free_balance(pool_id, who);
                //@audit only checked that share_amount will not result in dust liquidity
|>		ensure!(
			current_share_balance.saturating_add(share_amount) >= T::MinPoolLiquidity::get(),
			Error::<T>::InsufficientShareBalance
		);

(https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/stableswap/src/lib.rs#L475-L479)

As seen above, any non_zero/non_dust share_amount will be accepted. The user is unprotected from slippage when adding liquidity.

Tools Used

Manual

Recommended Mitigation Steps

Add slippage protection in add_liquidity(), similar to other trading and liquidity management methods.

Assessed type

Other

[c4-pre-sort]

0xRobocop marked the issue as duplicate of #158

[c4-judge]

OpenCoreCH marked the issue as satisfactory