VincentLegendLee
commented
2 years ago Evaluaton Results
Evaluated by:
- Vincent
- Themis Team
- Pecksheild
Risk Breakdown
Difficulty to Exploit: Easy Weakness: No check for Uniswap V3 fee tier CVSS2 Score: 8.8
Recommendation
- Add fees tier check as well while validating nft against which borrowing is happening
- Avoid using the spot price of a Uniswap V3 pool. Instead, use TWAP from the Uniswap pool to derive the amounts of the underlying tokens of an LP token.
Identified By:
Scorp:
Users can provide their Uniswap V3 LP positions as collateral when borrowing assets from the system. However, due to the use of vulnerable LP pricing formula, an attacker can drain all the funds in the pools by providing collateral much less than he should (thus leaving his position underwater).
Scenario & POC(Proof of Concept)
If we trace into the code, we will notice that the spot price of a Uniswap pool is used to evaluate the value of LP tokens (see below). However, using spot price from a Uniswap pool is vulnerable to price manipulation attacks, where the attacker can intentionally pump the value of his LP tokens:
getTWAPQuoteNftvalues in the given PoC code).Correction: In step 6. of the attack, the attack only does the reverse action of Step 3. (i.e., recover the pool to the normal state). He can't reverse Step 2 because his Uniswap V3 LP is given to the system as collateral. Notice that the attack can do all the above steps in separate transactions yet consecutively with the assistance of
flashbot. This prevents him from being arbitraged during the attack, which almost, if not always, guarantee he can succeed. The attacker chooses to create a new pool instead of manipulating the existing ones because, with less liquidity in the pool, he can easily imbalance the portion of the token with less capital. Besides, the system accepts all LP tokens from all fee tier pools, as long as the underlying tokens are allowlisted (see checkNftV3WhiteList in theThemisBorrowCompoundcontract).Usage of the spot price:
v3NFTBorrowofThemisBorrowCompoundallows users to borrow assets by collateralizing a Uniswap V3 LP token.uniswapV3Oracle.getTWAPQuoteNftis called to know how many borrowed tokens this Uniswap V3 LP is worth (line 276).getTWAPQuoteNft function, _calNftUsdValueis to get the LP token's value in USD (line 89)._calNftUsdValue,_getNFTAmountsis called to first get theamount0andamount1in the LP token (line 81)._getNFTAmounts function. The_poolTickvariable fetched from slot0 represents the spot price, which is, however, used to calculateamount0,amount1(line 162, 166).Impact
An attacker can drain the assets in the system's pools by under-collateralizing his Uniswap V3 LP tokens and manipulating the underlying Uniswap pool.