Nethermind Security(@NethermindSec):Every pending transaction in the mempool is a statement of intent. Bots read it before it settles and front-run what's worth front-running. The contract calls 𝘈𝘔𝘔.𝘴𝘸𝘢𝘱(𝘵𝘰𝘬𝘦𝘯𝘐𝘯, 𝘢𝘮𝘰𝘶𝘯𝘵𝘐𝘯, 𝟘). That zero is 100% slippage tolerance. A frontrunner inflates the price, lets the swap settle, sells back at profit. A 10,000 USDC trade returns 1 ETH instead of 5. 𝘳𝘦𝘲𝘶𝘪𝘳𝘦(𝘢𝘤𝘵𝘶𝘢𝘭𝘈𝘮𝘰𝘶𝘯𝘵𝘖𝘶𝘵 >= 𝘮𝘪𝘯𝘈𝘮𝘰𝘶𝘯𝘵𝘖𝘶𝘵) lets the user set their worst acceptable price. If a bot moves the price outside that range, the swap reverts. The attacker burns gas for nothing. The mempool stays public. Defense lives in the code, or it doesn't exist.

2026.05.11 13:07

Every pending transaction in the mempool is a statement of intent. Bots read it before it settles and front-run what's worth front-running. The contract calls 𝘈𝘔𝘔.𝘴𝘸𝘢𝘱(𝘵𝘰𝘬𝘦𝘯𝘐𝘯, 𝘢𝘮𝘰𝘶𝘯𝘵𝘐𝘯, 𝟘). That zero is 100% slippage tolerance. A frontrunner inflates the price, lets the swap settle, sells back at profit. A 10,000 USDC trade returns 1 ETH instead of 5. 𝘳𝘦𝘲𝘶𝘪𝘳𝘦(𝘢𝘤𝘵𝘶𝘢𝘭𝘈𝘮𝘰𝘶𝘯𝘵𝘖𝘶𝘵 >= 𝘮𝘪𝘯𝘈𝘮𝘰𝘶𝘯𝘵𝘖𝘶𝘵) lets the user set their worst acceptable price. If a bot moves the price outside that range, the swap reverts. The attacker burns gas for nothing. The mempool stays public. Defense lives in the code, or it doesn't exist.