Vector Reserve security record

A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker front-runs the victim trade by also buying asset Y, lets the victim execute the trade, and then executes another trade after the victim by trading back the amount gained in the first trade. Intuitively, one uses the knowledge that someone’s going to buy an asset and that this trade will increase its price, to make a profit. The attacker’s plan is to buy this asset cheaply, let the victim buy at an increased price, and then sell the received amount again at a higher price afterward. The swap performed in `swapETHForTokens()` and `addLiquidity()` for LP bonds (`WETHTOLP ` type) currently accept any amount of tokens in return, making them vulnerable to sandwich attacks. The Vector team should be aware of this possible attack, especially if the taxes in the Vector token are disabled, increasing the attacker's profitability, or if the max payout is sufficiently high to cover the fees plus some profit. Additionally, there have been cases with similar token contracts where an attacker could force the token contract to swap its balance in one pool which would lower its price, buy the token low in that pool, and sell it high in the second pool if the token is listed in multiple DEXs.