Open c4-bot-10 opened 6 months ago
0xRobocop marked the issue as duplicate of #73
Unlike #73, this does not demonstrate any relevant negative impact -> downgrading to QA
OpenCoreCH marked the issue as not a duplicate
OpenCoreCH changed the severity to QA (Quality Assurance)
OpenCoreCH marked the issue as grade-a
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L1567-L1573
Vulnerability details
Impact
Ema-oracle will show an arbitrary asset price, even though the asset was completely removed from the omnipool. Any other flows that consume ema-oracle price can be impacted as well.
Proof of Concept
The vulnerability is in the omnipool pallet (lib.rs)
remove_token()
. Typically, any liquidity management/trading will invoke a hook that calls ema-oracle pallet to update a spot oracle entry.However, the exception is that no hook is called in
remove_token()
, even thoughremove_token()
also changes liquidity and asset reserves, on top of completely deleting the asset from the pool.The impact is ema-oracle will still show an oracle entry price with an arbitrary value at user remove liquidity (
remove_liquidity
), even though the asset reserve is completely withdrawn inremove_token()
and the asset no longer exists.(1)For comparison, this is an example of a normal flow of liquidity change.
(https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L864)
(2) Problem:
remove_token()
doesn't call any hook to alert ema-oracle pallets the reserve is withdrawn and asset is deleted.(https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L1567-L1573)
Tools Used
Manual
Recommended Mitigation Steps
In
remove_token()
, add a hook that alerts ema-oracle the asset is withdrawn, and update the ema-oracle entry accordingly.Assessed type
Error