mediumFront-running / MEVOther
HydraDX: No `safe_withdrawal` option in `withdraw_protocol_liquidity` function in omnipool can be abused by frontrunners to cause losses to the admin when removing liquidity
- Payout
- $0
- Protocol
- HydraDX
- Disclosed
- Apr 10, 2024
- Source
- code4rena
HydraDX's omnipool exposes a `withdraw_protocol_liquidity` call for removing protocol-held LP positions that, unlike the parallel `remove_liquidity` path, has no `safe_withdrawal` option and therefore no `ensure_price` barrier. When an admin invokes it with a …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-02-hydradx-findings/issues/84
- https://github.com/code-423n4/2024-02-hydradx-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.