DeFi

Slippage

Slippage is the difference between the expected trade price and the actual execution price, often caused by liquidity, volatility, or transaction ordering.

The user expects one output amount, but the trade executes at a worse amount.

Slippage Explained in Detail

Slippage is the gap between the quoted trade price and the executed price. In DeFi, slippage usually appears when a swap moves through an AMM, aggregator, vault zap, liquidation path, or low-liquidity pool.

Some slippage is normal, but weak slippage checks can leak value or enable exploitation.

Transaction example

  1. Quote: The user expects 100 tokens out.

  2. Move: Market price changes before execution.

  3. Execute: The swap returns 94 tokens.

  4. Accept: The transaction succeeds because the minimum output was too low.

Slippage in Auditing

Slippage controls protect users and protocols from stale quotes, low liquidity, and sandwich attacks. A protocol swap with amountOutMin = 0 can leak value even if the Solidity code is otherwise correct.

Slippage also matters when a vault, liquidation, or strategy performs swaps on behalf of users.

Red flags in code

  • amountOutMin = 0.

  • Hardcoded slippage tolerance.

  • No deadline on swaps.

  • User cannot set a minimum output.

  • Protocol uses spot price as both quote and execution guard.

  • Low-liquidity pools are used for large trades.

  • Quote and execution happen across separate transactions without protection.

How to test or review it

  • Simulate price movement between quote and execution.

  • Test low-liquidity pools and volatile pairs.

  • Check whether minimum output is user-controlled or derived from a trusted quote.

  • Run front-running and sandwich simulations for user-facing swaps.

  • Verify protocol-owned swaps have conservative bounds and deadlines.

  • Review price manipulation and MEV assumptions when swaps affect collateral, shares, rewards, or liquidations.

Sandwich Attack

A sandwich attack is a front-running pattern where an attacker places one transaction before and one after a victim trade to profit from the victim's price impact.

Front-Running

Front-running is a transaction-ordering attack where an attacker observes a pending transaction and submits their own transaction so it executes first.

Price Manipulation

Price manipulation is the intentional movement of an asset, pool, share, or collateral price so a protocol values assets incorrectly.

MEV

MEV, or maximal extractable value, is value that can be extracted from transaction inclusion, exclusion, or ordering beyond normal block rewards and fees.

Frontrunning & Sandwich Attacks

Frontrunning and sandwich attacks in Solidity: how MEV bots extract value from DeFi traders, real examples, and slippage-based protections.

Oracle Manipulation & Price Manipulation

Oracle manipulation attacks distort price feeds, spot prices, and exchange rates. Learn Chainlink checks, TWAP defenses, and auditor review steps.

Smart Contract Audit Checklist

Use this SCH tool to turn the concept into practical audit work.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Slippage into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources