Use of `slot0` to get `sqrtPriceLimitX96` can lead to price manipulation.

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2023-11-panoptic/blob/main/contracts/SemiFungiblePositionManager.sol#L775

Vulnerability details

Impact:

In the SemiFungiblePositionManager.sol contract, the swapInAMM function relies on the UniswapV3.slot0 to obtain the value of sqrtPriceX96. This value is then used to calculate net0, which subsequently affects the swap which is done in_univ3pool.swap function.

This manipulation can result in significant financial losses when interacting with the _univ3pool.swap function.

Proof of Concept:

The issue lies in the fact that sqrtPriceX96 is retrieved from Uniswap.slot0, which represents the most recent data point and can be easily manipulated by malicious actors, particularly through MEV (Miner Extractable Value) bots and Flashloans in sandwich attacks.

The smart contract SemiFungiblePositionManager.sol fetches sqrtPriceX96 from slot0:

(uint160 sqrtPriceX96, , , , , , ) = _univ3pool.slot0();

This sqrtPriceX96 value is then used to compute different variables like net0, swapAmount which is finally being used in _univ3pool.swap function.

swapAmount is used to swap tokens in the Uniswap pool:

(int256 swap0, int256 swap1) = _univ3pool.swap(
    msg.sender,
    zeroForOne,
    swapAmount,
    zeroForOne
        ? Constants.MIN_V3POOL_SQRT_RATIO + 1
        : Constants.MAX_V3POOL_SQRT_RATIO - 1,
    data
);

According to Uniswap's documentation, sqrtPriceX96 represents the current price of the pool as a sqrt(token1/token0) Q64.96 value.

Tools Used:

Manual Review

Recommended Mitigation Steps:

To mitigate this vulnerability, it is advisable to use the TWAP (Time-Weighted Average Price) function to obtain the value of sqrtPriceX96. This would provide a more stable and less susceptible source of pricing data, reducing the risk of manipulation by malicious actors.

Assessed type

Uniswap

[c4-judge]

Picodes marked the issue as unsatisfactory: Insufficient proof

[Picodes]

sqrtPriceX96 can be manipulated but there are slippage control variables to mitigate this