search

code-423n4 / 2021-07-wildcredit-findings

0 stars 0 forks source link

Uniswap oracle assumes PairToken <> WETH liquidity #118

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

The UniswapV3Oracle.tokenPrice function gets the price by combining the chainlink ETH price with the TWAP prices of the token <> pairToken and pairToken <> WETH pools. It is therefore required that the pairToken <> WETH pool exists and has sufficient liquidity to be tamper-proof.

Impact

When listing lending pairs for tokens that have a WETH pair with low liquidity (at 0.3% fees) the prices can be easily manipulated leading to liquidations or underpriced borrows. This can happen for tokens that don't use WETH as their default trading pair, for example, if they prefer a stablecoin, or WBTC.

Recommendation

Ensure there's enough liquidity on the pairToken <> WETH Uniswap V3 0.3% pair, either manually or programmatically.

talegift commented 3 years ago

This is a known & documented risk: https://wild-credit.gitbook.io/wild-credit/advanced-concepts/price-oracles