search

code-423n4 / 2023-08-reserve-mitigation-findings

0 stars 0 forks source link

M-07 MitigationConfirmed #14

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

This issue is mitigated.

Explanation of found problem

The purpose of RevenueTrader is to trade revenue tokens into buyToken. In case if rToken is going to be sold, function calls melt, which burns some amount of RToken, which increases rate and price. But this will be called only if registry was not refreshed in same block. As result, anyone could frontrun manageToken function with call to the assetRegistry.refresh in order to not allow to melt rToken and make sellPrice to be lower.

Actually, i don't think that this move will be reflected in the oracle. Because, as you know oracle like chainlink have deviation, which means that price will be updated only when it will change by some percentage. Even if melting will change price for that deviation, which is unlikely, this price will not be updated in the oracle on the moment of trade.

How it was fixed

Reserve team has changed manageToken function to manageTokens and it processes several tokens at same time. In case if any of tokens is rToken, then melting will be done, no matter if asset registry was refreshed or not.

c4-judge commented 1 year ago

0xean marked the issue as satisfactory